Azure Storage GET not working with url shortner (CORS set to all domain *)

Question

Azure Storage GET not working with url shortner (CORS set to all domain *)

Robin Tan 61

I'm using a url shortner (custom hosted yourls) to redirect to a html page on azure blob storage. It works on a browser but when I do a GET without headers (I need this), it gives me an error.

I have set on CORS on azure storage to allow everything already

I tested with test-cors.org and it gives me

Sending GET request to https://yourls.com/testurl  
  
Fired XHR event: loadstart  
Fired XHR event: readystatechange  
Fired XHR event: error

Accepted answer

2 additional answers

Your answer

Answer 1

Tim Leyden 346

Given that it works with tinyurl and not your custom service I would focus on what is difference between these two services. When i test with test-cors and tinyurl I can see a cors http header in the response: access-control-allow-origin: http://test-cors.org. Your storage account config looks as permissive as it can get and if that tests okay from test-cors when you use the storage url directly i would be looking elsewhere.

Tim

Robin Tan 61 Reputation points

2021-08-02T06:23:11.717+00:00

Thanks, I'm reported the issue to yourls too.

https://github.com/YOURLS/YOURLS/discussions/3011

Just to confirm it's not an issue with Azure storage configuration (I know allow * is not good, I've to make sure it works first)
Robin Tan 61 Reputation points

2021-08-02T07:24:18.327+00:00

I have reported on their github

https://github.com/YOURLS/YOURLS/discussions/3011

Answer 2

@Robin Tan

I just tested this using tinyurl and did not have any issues making a GET request to the tinyurl. I suspect this might be an issue specific to the URL shortener you are using. I recommend testing with some common URL shorteners to see if you are still facing issue. If it is specific to this URL shortener I recommend investigating and perhaps opening up an issue on their GitHub page.

Hope this helps. Let me know if you have further questions or issues and I will be happy to assist.

-------------------------------

Please don’t forget to "Accept the answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 3

Robin Tan 61

Hi Deherman, you are correct. It does work on tinyurl, but not yourls. Anyway on the azure storage side to diagnose it (see header request etc?). I could switch shortner but I like to know to diagnose, if possible.

Tim Leyden 346 Reputation points

2021-07-30T02:06:31.71+00:00

Hi @Robin Tan
Its likely that the browser is not allowing the request to continue because its enforcing cors on your short url service. If you look at the headers set by a service like tinyurl you can see it adds a cors header in the response for the referrer e.g access-control-allow-origin: http://test-cors.org
. The first thing I would check is that your custom service is doing the same. There maybe some configuration or a plugin you need to add to enable this.
You can enable more logging on the storage account by using a diagnostic setting or enabling the classic logs. This will give you detailed information about failed and successful requests. monitor-blob-storage
Robin Tan 61 Reputation points

2021-07-30T06:02:43.117+00:00

Thanks , but I have put Allowed Origin * on CORS tab , shold that mean it should be allowed and don't need the header, no?
Tim Leyden 346 Reputation points

2021-08-01T06:35:31.2+00:00

the initial request is going to your url shortening service not to the storage account. Can you confirm you have enabled cors on the url shortening service? This would explain why it works for tinurl and not your custom service. Use the network tab in your browser developer tools to validate the request is actually getting sent to the storage account. If cors isn't the issue and you can see the browser making the request correlate the request with the diagnostic logs i mentioned earlier to see if you can get more information.
Thanks
Tim
Robin Tan 61 Reputation points

2021-08-01T14:37:03.937+00:00

IIt's definitely a CORS block as I see that error in the log (after I enabled diagnostic)

YourLS doesn't have a CORS enable option, and I'm still trying to understand how CORS actually work.

The storage server response should have Access-Control-Allow-Origin: * but that is not sent back to the client (browser). Both TinyURL and YourLS response 302 and 301 ((redirect) which cause browser to resend the request again. The response headers don't have "Access-Control-Allow" field. Both work in browser, but only tinyurl works with https://test-cors.org

In test-cors.org, tinyurul response is 301, but YouurLS response is a CORS block

Share via

Azure Storage GET not working with url shortner (CORS set to all domain *)

2 additional answers

Your answer