"Download Brackets without Extract" link on brackets.io blocked

[anewuser]

The "Download Brackets without Extract" link on brackets.io doesn't work for me (Firefox 36.0 on Windows) when HTTPS Everywhere is enabled. I opened the console and found this:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://s3.amazonaws.com/files.brackets.io/updates/stable/en.json?_=1424389017263. This can be fixed by moving the resource to the same domain or enabling CORS.

I've opened an issue on the brackets.io repository about this. Their developer is willing to help but doesn't use HTTPS Everywhere. Can you point what the exact problem is, and if there is any way for him or you to solve it?

[jsha]

There appears to be an interaction between HTTPS Everywhere and CORS that we are trying to solve: #49. In the meantime, the simplest thing the developer can do to help is to change the URLs fetched with CORS to point to the HTTPS version, e.g. httpS://s3.amazonaws.com/files.brackets.io/updates/stable/en.json?_=1424389017263. AFAIK S3 doesn't charge extra for using the HTTPS version, per http://aws.amazon.com/s3/pricing/.

Thanks,
Jacob

[TheNavigat]

Can someone confirm that this isn't solve yet? If it isn't, any instructions on how to reproduce the issue?

[jsha]

I was able to reproduce using the instructions in the first post: Visit brackets.io, then click the "download brackets without extract" link (it's small)..

[TheNavigat]

Oh, my bad. The link works perfectly on Chrome, but not Firefox.

[fuzzyroddis]

I can confirm it works on Chrome but not Firefox too.
I get really strange behaviour on Firefox the en.json (fairly sure it's called that, it was yesterday when I tried) appears to respond with Access-Control-Allow-Origin: * on Firefox but is blocked for not having Access-Control-Allow-Origin. But on Chrome it appears to respond with Access-Control-Allow-Origin: http://brackets.io and works.

It's served over S3 which I don't think has the capability to send different headers based on user-agent. Could this be a problem in the extension?

[fuzzyroddis]

Just tried again on Firefox 42.0a

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, HEAD

(This was also with the Amazon S3 ruleset disabled)

Interestingly via curl I don't get any Access-Control headers, perhaps because I'm not sending an Origin?
Yep,

curl -H "Origin: brackets.io" http://s3.amazonaws.com/files.brackets.io/updates/stable/en.json?_=1234

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, HEAD
Access-Control-Max-Age: 3000

I'm going to assume Chrome is doing something silly, I checked and according to the devtools it's responding with Access-Control-Allow-Origin: http://brackets.io

On enabling the Amazon S3 ruleset in HTTPSE for Firefox:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://s3.amazonaws.com/files.brackets.io/updates/stable/en.json?_=1440474832738. (Reason: CORS header 'Access-Control-Allow-Origin' missing).

Could the extension be stripping the Access-Control-Allow-Origin header, or not sending the Origin header?

[fuzzyroddis]

Also of note is when checking with Fiddler and Wireshark, I couldn't see Firefox actually make a connection to s3.amazonaws.com when the ruleset is enabled, but it does state in the error console that it was blocked due to no Access-Control-Allow-Origin header. Which doesn't make sense if it never requested the resource in the first place. None of the Client Hellos I recorded had s3.amazonaws.com in their SNI. Which suggests to me Firefox isn't even making the request.

[TheNavigat]

@fuzzyroddis, "I get really strange behaviour on Firefox the en.json (fairly sure it's called that, it was yesterday when I tried) appears to respond with Access-Control-Allow-Origin: * on Firefox but is blocked for not having Access-Control-Allow-Origin. But on Chrome it appears to respond with Access-Control-Allow-Origin: http://brackets.io and works."

https://stackoverflow.com/questions/26946240/firefox-setresponseheader-isnt-working#comment42479840_26952560

If you're manipulating the headers before the request is processed, Firefox will show the original request's data, although the errors displayed will correspond to the manipulated and processed ones. Don't trust the Network tab if you're working on a Firefox add-on.

In other words, the extension is probably doing something wrong that leads to stripping the Access-Control-Allow-Origin header. However, Chrome's network tab shows that, Firefox's won't.

Also, regarding your last comment, are you sure the file isn't cached?

[fuzzyroddis]

@TheNavigat I'm 99% sure the file isn't cached as every other resource is grabbed again.
I was even intercepting HTTPS connections just to see what Firefox ultimately sent.

Could someone please try to reproduce? I'm happy to be proven wrong.

I'm uncomfortable with adding an exception just for this url as I have a feeling it's a bug with the extension.

[fuzzyroddis]

Just confirmed that no connection was made to s3.amazonaws.com using Firefox with the ruleset enabled.