[GH-ISSUE #232] Using BasicAuth causes Shiori UI to not show up in Safari (blocked cross-origin request) #174

New issue

Closed

opened 2026-02-25 23:33:37 +03:00 by kerem · 3 comments

kerem commented

2026-02-25 23:33:37 +03:00

Owner

Originally created by @Pixtriks on GitHub (Feb 15, 2020).
Original GitHub issue: https://github.com/go-shiori/shiori/issues/232

When running Shiori behind Traefik and BasicAuth the following errors pop-up in the Safari inspector:

[Error] Blocked https://example.com/js/component/bookmark.js from asking for credentials because it is a cross-origin request.
[Error] Blocked https://example.com/js/component/pagination.js from asking for credentials because it is a cross-origin request.
[Error] Blocked https://example.com/js/page/home.js from asking for credentials because it is a cross-origin request.
[Error] Blocked https://example.com/js/component/dialog.js from asking for credentials because it is a cross-origin request.
[Error] Blocked https://example.com/js/page/setting.js from asking for credentials because it is a cross-origin request.
[Error] Blocked https://example.com/js/page/base.js from asking for credentials because it is a cross-origin request.

These errors cause the UI to not work on macOS and iOS Safari.
The issue does not occur when using Firefox. Tested on macOS 10.15.2 and iOS 13.3.

Originally created by @Pixtriks on GitHub (Feb 15, 2020). Original GitHub issue: https://github.com/go-shiori/shiori/issues/232 When running Shiori behind Traefik and BasicAuth the following errors pop-up in the Safari inspector: ``` [Error] Blocked https://example.com/js/component/bookmark.js from asking for credentials because it is a cross-origin request. [Error] Blocked https://example.com/js/component/pagination.js from asking for credentials because it is a cross-origin request. [Error] Blocked https://example.com/js/page/home.js from asking for credentials because it is a cross-origin request. [Error] Blocked https://example.com/js/component/dialog.js from asking for credentials because it is a cross-origin request. [Error] Blocked https://example.com/js/page/setting.js from asking for credentials because it is a cross-origin request. [Error] Blocked https://example.com/js/page/base.js from asking for credentials because it is a cross-origin request. ``` These errors cause the UI to not work on macOS and iOS Safari. The issue does not occur when using Firefox. Tested on macOS 10.15.2 and iOS 13.3. This may be related: https://stackoverflow.com/questions/56557082/safari-blocked-https-from-asking-for-credentials-because-it-is-a-cross-o <img width="985" alt="Capture d’écran 2020-02-15 à 17 31 58" src="https://user-images.githubusercontent.com/6831735/74591563-33b31400-5019-11ea-8307-ffda7fb097b6.png"> <img width="1240" alt="Capture d’écran 2020-02-15 à 17 31 19" src="https://user-images.githubusercontent.com/6831735/74591564-36ae0480-5019-11ea-97fe-1f1d1fa587ac.png">

kerem

2026-02-25 23:33:37 +03:00

closed this issue
added the
component:backend

tag:help-wanted

tag:stale

tag:more-info
labels

kerem commented

2026-02-25 23:33:37 +03:00

Author

Owner

@Pixtriks commented on GitHub (Feb 21, 2020):

The same issue occurs while using traefik-forward-auth in combination with an OpenID Connect provider. It looks like Shiori is having difficulties with handeling the authentication token/cookie. Maybe something can be changed in the way the JavaScript code requests these files?

@Pixtriks commented on GitHub (Feb 21, 2020): The same issue occurs while using traefik-forward-auth in combination with an OpenID Connect provider. It looks like Shiori is having difficulties with handeling the authentication token/cookie. Maybe something can be changed in the way the JavaScript code requests these files?

kerem commented

2026-02-25 23:33:37 +03:00

Author

Owner

@deanishe commented on GitHub (Aug 6, 2020):

Could you please post the full request from the web inspector? It sounds like Traefik might be sending headers that are telling the browser not to allow Shiori.

@deanishe commented on GitHub (Aug 6, 2020): Could you please post the full request from the web inspector? It sounds like Traefik might be sending headers that are telling the browser not to allow Shiori.

kerem commented

2026-02-25 23:33:37 +03:00

Author

Owner

@stale[bot] commented on GitHub (Mar 31, 2022):

This issue has been automatically marked as stale because it has not had any activity for quite some time.
It will be closed if no further activity occurs.
Thank you for your contributions.

@stale[bot] commented on GitHub (Mar 31, 2022): This issue has been automatically marked as stale because it has not had any activity for quite some time. It will be closed if no further activity occurs. Thank you for your contributions.