CEF iframe CORS issue

[magreenblatt]

Fix your CDN to return the correct Access-Control-Allow-Headers and Access-Control-Allow-Methods. See https://developer.mozilla.org/en-US/doc ... ds/OPTIONS

[rsharma07]

@magreenblatt, may you please share some idea about it?

Hi everyone, we have updated our browser application to 4324 and we are getting a problem loading of some icons from our internal CDN, this error is related to CORS policy:

Access to font at 'https://cdn.NAME.com/thief-angular/2.18.0/fonts/thief-icons.woff' from origin 'https://*.apps.NAME.com' has been blocked by CORS policy: Request header field authorization is not allowed by Access-Control-Allow-Headers in preflight response.

We were not getting any problem with this flag "disable-features=OutOfBlinkCors", it seems, it has disabled in CEF now: https://bitbucket.org/chromiumembedded/ ... -not-fully

Running with "--disable-web-security" fixes the problem, but it might create some security issues.
Is there any alternative for this?

Thank you.