CORS issue in cefsharp.winforms when not in Chrome

[smillsoper]

I came across a CORS issue in CefSharp.Winforms when in full-blown Chrome, I don't get the CORS errors.

I had not done any javascript/jquery injection and still got the errors.

To reproduce, navigate to https://scoopfit.com and select a product to order, and go through the checkout process up until the payment method options. Select Afterpay and click pay now (don't worry, we're not actually ordering).

Once that page loads, open developer tools and go to the console tab.

If the above was done in Chrome, there will be no CORS errors although there are some other errors regarding inline scripts and resource load errors (but that's just Shopify - I expect to see that).

If the above was loaded in CefSharp, there are a number of CORS errors.

I have attempted to initialize chrome with the disable-web-security command line option, but that does not disable CORS. Is there something I can do to circumvent this issue? This is the first time I have come across this issue.

I'm using the latest version of CefSharp.WinForms (v105); and also had the same issue on version 99. I updated to 105 from 99 to see if it would correct the issue, but it did not.

I have also attempted using the AddCrossOriginWhitelistEntry() method still to no avail (although I expected that not to work as I have seen that this method needs to be corrected in another discussion).

This one has me totally stumped just for the fact that I'm not making any requests other than just loading the site as in a full Chrome browser and not getting the same result. With those CORS errors, even if you populate the phone number or email address, the submit button will not work and you will see 'too many requests' errors when you click that button.

any help would be appreciated.

[amaitland]

You'll need to test with the CEF Sample Application as I suspect this would need to be fixed upstream.

CEF has it's own issue tracker at https://bitbucket.org/chromiumembedded/cef/issues?status=new&status=open

It's probably worth trying to disable CEF's network interceptor via the --disable-request-handling-for-testing command line arg to see if you get a different result.

I have also attempted using the AddCrossOriginWhitelistEntry() method still to no avail (although I expected that not to work as I have seen that this method needs to be corrected in another discussion).

This is also a CEF issue see https://bitbucket.org/chromiumembedded/cef/issues/2918/cefaddcrossoriginwhitelistentry-not-fully

It's unlikely this can be fixed directly in CefSharp.

[amaitland]

@smillsoper Thanks for the detailed testing 👍 Can you confirm that your company is currently a sponsor or has a support arrangement in place? If yes please let me know which company and I'll happily prioritise looking into this.

[smillsoper]

Hi Alex I am now a sponsor. Glad to help out. CefSharp has become a major part of our call center software so was a no brainer for me. Thank you!

[amaitland]

Thanks 👍

After quite a bit of digging it looks like the behaviour you are seeing is deliberate on behalf of the website, it looks like they are detecting that CefSharp is being used and altering behaviour.

Try renaming or disabling the object CefSharp creates in javascript (pick one).

//Rename object that CefSharp creates from cefSharp to notCefSharp (use your own name if you choose this option)
browser.JavascriptObjectRepository.Settings.JavascriptBindingApiGlobalObjectName = "notCefSharp";

//Disable creation of window.cefSharp and window.CefSharp
browser.JavascriptObjectRepository.Settings.JavascriptBindingApiEnabled = false;

If the problem still persists after making this change then try deleting the cache and retesting.

[smillsoper]

Thanks @amaitland, I'll give that a try.

[smillsoper]

@amaitland Fantastic! changing browser.JavascriptObjectRepository.Settings.JavascriptBindingApiGlobalObjectName did the trick! You're an amazing human being.