The JavaScript SDK needs to be served with access-control-allow-origin: *
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 254
- Forks
- 53
- PR merge metrics
- No merged PRs in 30d
Description
Title: The JavaScript SDK needs to be served with access-control-allow-origin: *
Endpoint(s):
GET https://connect.soundcloud.com/sdk/sdk-3.0.0.js
Scope(s):
- None
Steps to reproduce:
Serve a page containing this:
<!DOCTYPE html>
<html>
<head>
<script src="https://connect.soundcloud.com/sdk/sdk-3.0.0.js"></script>
</head>
<body>
</body>
</html>
With this HTTP header:
Cross-Origin-Embedder-Policy: require-corp
Expected behaviour:
The JavaScript sdk should load, and a window.SC object be present.
Actual behaviour:
The SoundCloud SDK fails to load with this error in the console:
GET https://connect.soundcloud.com/sdk/sdk-3.0.0.js net::ERR_BLOCKED_BY_RESPONSE
And with this status in the network tab:
(blocked:NotSameOriginAfterDefaultedToSameOriginByCoep)
The sdk.js file needs to be served with this header in order to load in presence of the COEP header:
access-control-allow-origin: *
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by checking the response headers for GET https://connect.soundcloud.com/sdk/sdk-3.0.0.js and how that SDK endpoint is served. Verify the SDK loads and exposes window.SC when a page uses Cross-Origin-Embedder-Policy: require-corp, and confirm the response includes access-control-allow-origin: *.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- api
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100