Repository navigation
[Bug]: Electron How to avoid CORS-RFC1918 (private network)? #33133
Description
Preflight Checklist
- I have read the Contributing Guidelines for this project.
- I agree to follow the Code of Conduct that this project adheres to.
- I have searched the issue tracker for a bug report that matches the one I want to file, without success.
Electron Version
16.0.5
What operating system are you using?
Windows
Operating System Version
windows 10 1909
What arch are you using?
x64
Last Known Working Electron version
No response
Expected Behavior
connect the websocket
Actual Behavior
Electron v16.0.5
My BrowserWindow uses loadURL, and the web page loaded calls api from another host. I cannot modify the web. The web works fine in normal browser like chrome, though it requires a little cross origin settings for chrome to work.
How can I make electron to avoid the cors policy ?
Here are the methods I've tried. All together, not one by one.
webSecurity: false
app.commandLine.appendSwitch('disable-features', 'OutOfBlinkCors')
app.commandLine.appendSwitch('disable-site-isolation-trials')
onBeforeSendHeaders, requestHeaders, add "Origin", "Access-Control-Request-Method", "Access-Control-Request-Private-Network"
onHeadersReceived, responseHeaders, add "Access-Control-Allow-Origin", "Access-Control-Allow-Private-Network"
Here is the error in the console of electron.
Access to XMLHttpRequest at 'http://xxxxxx.com' from origin 'http://yyyyyyy.com' has been blocked by CORS policy: The request client is not a secure context and the resource is in more-private address space private.
Once I adding the code below, it shows another error
app.commandLine.appendSwitch('disable-features', 'BlockInsecurePrivateNetworkRequests')
The error changes to
Access to XMLHttpRequest at 'http://xxxxxx.com' from origin 'http://yyyyyyy.com' has been blocked by CORS policy: Request had no target IP address space, yet the resource is in address space private.
Testcase Gist URL
No response
Additional Information
No response
Activity
dheerajkysetti commentedon Mar 26, 2022
@tanchaopeng Were you able to resolve this issue, which does not involve changing the way a website is served?
I am facing a the same issue and appear to have exhausted options, I have currently rolled back to previous version of electron, which runs chromium version older than 98.
sheng-di commentedon Jun 13, 2022
+1
tanch007 commentedon Aug 8, 2022
@dheerajkysetti you can add code
app.commandLine.appendSwitch('disable-features','BlockInsecurePrivateNetworkRequests')dheerajkysetti commentedon Nov 25, 2022
Hi @tanchaopeng on electron version 21.3.0( amc and linux), this issues still exists and the disable features switch didnt work.
The same works on electron version 19.0.13.
is this bug being tracked anywhere?
@electron-triage
MounicaChanda0809 commentedon Nov 29, 2022
Hi still seeing this issue. I am on electron 21.1.1. Tried all appendSwitch sugesstions
flavinlouise commentedon Dec 17, 2022
have same issue in 21.2.0
AZforyo commentedon Jan 4, 2023
@tanchaopeng Have you solved the problem? please tell me how to do!!!!
求教！
AZforyo commentedon Jan 4, 2023
Have you solved the problem? please tell me how to do!!!!
cnhuye commentedon Mar 12, 2023
I have same problem on electron 20.1.3, this DONT work for me :
Following this answer, #37435 (comment),
change the electron to 19.0.13, it worked.
raymon610 commentedon Aug 28, 2023
app.commandLine.appendSwitch('disable-web-security');
on electron 25.0.1 it work
dtychshenko commentedon Oct 17, 2023
Beware that
disable-web-securityflag will disable all CORS checks among a few other things besides CORS-RFC1918 Private Network Access (PNA) checks. For us, disabling all of web security was too lax and we wanted to disable only PNA temporarily.Also note that the way the related PNA flags behave can vary greatly between different versions of Chromium, which is why disabling
BlockInsecurePrivateNetworkRequestsflag alone works for some, but not others. In our case, I had to dig through the Chromium source code of the version used by the Electron version that we use to figure out how to disable PNA checks.So in our case using Electron 22.3.15 which uses Chrome 108.0.5359.215, the following will disable PNA/CORS-RFC1918:
There is also an option to override the specific IP addresses to a particular space; however, the IP addresses specified have to be exact, i.e. you can't override ranges or subnets:
In this example, when PNA check is done, a resource with IP address
158.11.22.33on port 443 will be considered to be inlocalspace, rather thanpublic. Similarly,10.45.56.67is generally aprivateaddress, but we can override it to be consideredpublic.