理由
Reason: CORS header ‘Origin’ cannot be added
何が悪いのか
ユーザーエージェントが必要な Origin を HTTP リクエストに追加することができませんでした。すべての CORS リクエストは Origin ヘッダーを含んでいなければなりません。
これは例えば、 JavaScript のコードが複数のドメインのコンテンツにアクセスできるよう高い権限で実行されている場合などに起こることがあります。
Reason: CORS header ‘Origin’ cannot be added
関連トピック
- HTTP
- Guides:
- HTTP access control (CORS)
- HTTP authentication
- HTTP caching
- HTTP compression
- HTTP conditional requests
- HTTP content negotiation
- HTTP cookies
- HTTP range requests
- HTTP redirects
- HTTP specifications
- Feature policy
- References:
-
HTTP headers
AcceptAccept-CharsetAccept-EncodingAccept-LanguageAccept-RangesAccess-Control-Allow-CredentialsAccess-Control-Allow-HeadersAccess-Control-Allow-MethodsAccess-Control-Allow-OriginAccess-Control-Expose-HeadersAccess-Control-Max-AgeAccess-Control-Request-HeadersAccess-Control-Request-MethodAgeAllowAlt-Svc[翻訳する]AuthorizationCache-ControlClear-Site-DataConnectionContent-DispositionContent-EncodingContent-LanguageContent-LengthContent-LocationContent-RangeContent-Security-PolicyContent-Security-Policy-Report-OnlyContent-TypeCookieCookie2DNTDateETagEarly-DataExpectExpect-CTExpiresFeature-PolicyForwardedFromHostIf-MatchIf-Modified-SinceIf-None-MatchIf-RangeIf-Unmodified-Since索引Keep-AliveLarge-Allocation[翻訳する]Last-ModifiedLocationOriginPragmaProxy-AuthenticateProxy-Authorization[翻訳する]Public-Key-Pins[翻訳する]Public-Key-Pins-Report-Only[翻訳する]RangeRefererReferrer-PolicyRetry-AfterSec-WebSocket-Accept[翻訳する]ServerServer-TimingSet-CookieSet-Cookie2SourceMapHTTP Strict Transport SecurityTE[翻訳する]Timing-Allow-Origin[翻訳する]TkTrailer[翻訳する]Transfer-EncodingUpgrade-Insecure-Requests[翻訳する]User-AgentVaryVia[翻訳する]WWW-AuthenticateWarning[翻訳する]X-Content-Type-Options[翻訳する]X-DNS-Prefetch-ControlX-Forwarded-ForX-Forwarded-HostX-Forwarded-ProtoX-Frame-OptionsX-XSS-Protection
-
HTTP response status codes
100 Continue101 Switching Protocols200 OK201 Created202 Accepted203 Non-Authoritative Information204 No Content205 Reset Content206 Partial Content300 Multiple Choices301 Moved Permanently302 Found303 See Other304 Not Modified307 Temporary Redirect308 Permanent Redirect400 Bad Request401 Unauthorized403 Forbidden404 Not Found405 Method Not Allowed406 Not Acceptable407 Proxy Authentication Required408 Request Timeout409 Conflict410 Gone411 Length Required412 Precondition Failed413 Payload Too Large414 URI Too Long415 Unsupported Media Type416 Range Not Satisfiable417 Expectation Failed418 I'm a teapot422 Unprocessable Entity425 Too Early426 Upgrade Required428 Precondition Required429 Too Many Requests431 Request Header Fields Too Large451 Unavailable For Legal Reasons500 Internal Server Error501 Not Implemented502 Bad Gateway503 Service Unavailable504 Gateway Timeout505 HTTP Version Not Supported511 Network Authentication Required
-
CSP directives
CSP: base-uriCSP: block-all-mixed-contentCSP: child-src[翻訳する]CSP: connect-src[翻訳する]CSP: default-srcCSP: font-src[翻訳する]CSP: form-action[翻訳する]CSP: frame-ancestors[翻訳する]CSP: frame-src[翻訳する]CSP: img-src[翻訳する]CSP: manifest-src[翻訳する]CSP: media-src[翻訳する]CSP: object-src[翻訳する]CSP: plugin-types[翻訳する]CSP: referrerCSP: report-uri[翻訳する]CSP: require-sri-for[翻訳する]CSP: sandbox[翻訳する]CSP: script-srcCSP: style-src[翻訳する]CSP: upgrade-insecure-requestsCSP: worker-srcreport-to
-
CORS errors
- Reason: CORS disabled
- Reason: CORS header 'Access-Control-Allow-Origin' does not match 'xyz'
- Reason: CORS header 'Access-Control-Allow-Origin' missing
- Reason: CORS header ‘Origin’ cannot be added
- Reason: CORS preflight channel did not succeed
- Reason: CORS request did not succeed
- Reason: CORS request external redirect not allowed
- Reason: CORS request not HTTP
- Reason: Credential is not supported if the CORS header ‘Access-Control-Allow-Origin’ is ‘*’
- Reason: Did not find method in CORS header ‘Access-Control-Allow-Methods’
- Reason: Multiple CORS header 'Access-Control-Allow-Origin' not allowed
- Reason: expected ‘true’ in CORS header ‘Access-Control-Allow-Credentials’
- Reason: invalid token ‘xyz’ in CORS header ‘Access-Control-Allow-Headers’
- Reason: invalid token ‘xyz’ in CORS header ‘Access-Control-Allow-Methods’
- Reason: missing token ‘xyz’ in CORS header ‘Access-Control-Allow-Headers’ from CORS preflight channel