2

I have a Heroku app making AJAX requests to my cloudfront distribution via JQuery. When I load my website from myapp.herokuapp.com, everything works perfectly.

When I access the app from my custom domain (which is something like myapp.subdomain.domain.com), I get this:

XMLHttpRequest cannot load [cloudfront dist here]/something.json. Origin http://myapp.subdomain.domain.com is not allowed by Access-Control-Allow-Origin.

It's pretty weird. In my S3 CORS config, I'm allowing all domains with a *:

<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
    <CORSRule>
        <AllowedOrigin>*</AllowedOrigin>
        <AllowedMethod>GET</AllowedMethod>
        <MaxAgeSeconds>3000</MaxAgeSeconds>
        <AllowedHeader>Authorization</AllowedHeader>
    </CORSRule>
</CORSConfiguration>

Why would this happen? Any ideas?

1 Answer 1

4

You are probably getting bitten by this S3/CloudFront bug https://forums.aws.amazon.com/thread.jspa?messageID=377513

when S3 sees request come in from myapp.herokuapp.com, it rewrites Access-Control-Allow-Origin: myapp.herokuapp.com, not the * you expect it to. And the CF caches that. So secondary requests from different domains will fail CORS validation, even when using the same CF distribution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.