Firefox cross origin error for iframe with same domain page

Question

I'm working on a small ASP.NET site with a simple page that contains an UpdatePanel which contains

a fixed size div which appears as a modal popup
a button to close it
an iframe, its source a plain page from the same domain

The domain is http://localhost:8080 and the code is as follows:

<asp:UpdatePanel ID="Popup" UpdateMode="Conditional" runat="server">
<ContentTemplate>
    <div id="Container" class="modal" runat="server">
        <div>
            <asp:LinkButton OnClick="ClosePopup" runat="server" />
            <div>
                <iframe src="http://localhost:8080/somepage" />
            </div>
        </div>
    </div>
</ContentTemplate>

In Firefox, just opening and closing the popup is enough to cause the following error:

"Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost:51057/2a5e6f1d3ba752cf/arterySignalR/poll?transport=longPolling&connectionToken=AQAAANCMnd8BF..."

I read many posts but they seem to all deal with actual cross-origin requests, which, as far as the code is concerned, is not the case here. I tried putting the following in web.config but it makes no difference:

<httpProtocol>
  <customHeaders>
    <add name="Access-Control-Allow-Origin" value="*" />
  </customHeaders>
 </httpProtocol>

No code is executed other than opening and closing the popup. It appears the ClosePopup event is hit after the message appears, but that may just be caused by some VS2013 delay. The site does not use SignalR but the error contains a SignalR reference.

Functionality is not affected but I want to understand why this happens. The error only occurs in Firefox (34). It seems obvious the SignalR reference is the culprit, but why would it be there in the first place? Does anyone know what could be causing this?

score 1 · Accepted Answer · edited May 23 '17 at 12:30

Browser Link is a feature introduced in Visual Studio 2013 that uses SignalR to provide some neat development features. Here is a 3 minute video demonstrating what Browser Link does.

Browser Link isn't trying to connect to your website, but instead it is trying to communicate with Visual Studio itself. This issue should not come up unless you are starting your project with Visual Studio.

This explains why changing your web.config to allow CORS has no impact on this issue. I would be careful with universally enabling CORS since this could open you up to XSS vulnerabilities if you are not careful.

Disabling Browser Link should fix the issue. You can even selectively disable Browser Link.

Firefox cross origin error for iframe with same domain page

1 Answers1