Disabling "Out of blink CORS" breaks YouTube
Reported by
khym.cha...@gmail.com,
Aug 2
|
||||||||
Issue descriptionUserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36 Example URL: https://www.youtube.com/watch?v=1yATFrNUAFw Steps to reproduce the problem: 1. Go to chrome://flags/#out-of-blink-cors and disable Out of blink CORS 2. Restart browser 3. Go view any YouTube video. What is the expected behavior? Video still plays What went wrong? Video doesn't play. The JavaScript console is full of errors like Failed to load https://r1---sn-n4v7sn7z.googlevideo.com/videoplayback?key=yt6&dur=2992.941&source=youtube&lmt=1408172508353746&expire=1533270309&clen=60093229&ipbits=0&pl=34&mime=audio%2Fwebm&sparams=clen%2Cdur%2Cei%2Cgir%2Cid%2Cinitcwndbps%2Cip%2Cipbits%2Citag%2Ckeepalive%2Clmt%2Cmime%2Cmm%2Cmn%2Cms%2Cmv%2Cpl%2Crequiressl%2Csource%2Cexpire&mv=m&mt=1533248622&ms=au%2Crdu&itag=251&ei=xYRjW8SoDOmn-AOcw7fAAQ&mn=sn-n4v7sn7z%2Csn-o097znlr&mm=31%2C29&initcwndbps=1651250&keepalive=yes&c=WEB&id=o-AB2kNRVgtDO0oiPoMyYmvArg1pCyiMu_xM-9hlJPqIBH&requiressl=yes&ip=2601%3A644%3A101%3A23da%3A%3Abe46&signature=DA03B685CF521708E81A61F271300570812CD7CC.11297DB67D5EF1A5B1A609984A0B199F1E5F890E&gir=yes&fvip=4&alr=yes&cpn=KN4z3034rrp_ghyQ&cver=1.20180801&range=0-5586&rn=1&rbuf=0: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://www.youtube.com' is therefore not allowed access. Did this work before? Yes Chrome version: 68.0.3440.84 Channel: stable OS Version: Fedora 28 Flash Version: If out of blink CORS is required then it shouldn't be possible to disable it.
,
Aug 3
Unable to reproduce the issue on ubuntu 17.10 using chrome reported version #68.0.3440.84 and latest chrome version #70.0.3509.0. Attached a screen cast for reference. Following are the steps followed to reproduce the issue. ------------ 1. Navigated to chrome://flags/#out-of-blink-cors and disabled Out of blink CORS 2. Restarted browser 3. Navigated to https://www.youtube.com/watch?v=1yATFrNUAFw and observed that the video played without any issues. khym.chanur@ - Could you please check the issue on latest stable #68.0.3440.84 by creating a new profile without any apps and extensions and please let us know if the issue still persist or not. Thanks...!!
,
Aug 3
I created a new profile, and the new profile did not have the problem. Going back to my default profile, I used the developer tools "Application" tab to unregister the service workers for YouTube and reloaded the page, which fixed the problem. So some sort of problem with outdated service workers interacting with blink CORS?
,
Aug 3
Oh, before I tried unregistering the service workers, I tried restarting Chrome with extensions disabled; that did not fix the problem.
,
Aug 3
Thank you for providing more feedback. Adding the requester to the cc list. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Aug 3
,
Aug 3
,
Aug 3
,
Aug 3
I think I've figured out how to reproduce this: 1. Enable out of blink CORS (chrome://flags/#out-of-blink-cors) and restart browser. 2. Create a new profile, and do the following steps with that profile. 3. Go to a YouTube video. 4. Disable out of blink CORS and restart the browser. 5. Go back to the same YouTube video. 6. Unregister YouTube service workers to get things working again while out of blink CORS is still disabled. So maybe the YouTube devs put some code to work around some subtle differences between the different CORS implementations, but only detect the difference on service worker registration rather than every time the browser starts?
,
Aug 6
Thank you for a detailed report. Out-of-blink CORS expects some other dependent features enabled to work with service worker correctly. (and also the feature is still incomplete) So, my guess is that the YT's SW got some unexpected failures around CORS related network actions at the step 3, and continues to be confused regardless of the CORS flag flipped, then reinstalling the SW fixes it at the step 5. Unsupported flags may not work, and may make an existing profile in a broken state. So, this is a possible and an expected failure. yhirano: If you also do not have any concern, we will close this report as WontFix.
,
Aug 7
I think maybe disabling out of blink CORS actually *DOES* break YouTube. I disabled out of blink CORS due to issue 870946 , and the "No 'Access-Control-Allow-Origin' header is present on the requested resource" is intermittently appearing for YouTube videos. When it happens I use the console's application tab to clear all non-cookie data from YouTube, reload the video page, and the problem goes away, but it comes back soon when I start playing other videos. Perhaps it's because I have multiple YouTube video tabs open with just one playing? I'll open up a video, watch it for a minute, pause it, open up a tab for another video, then repeat the process. I also restart Chrome with "start up where I left off" with several YouTube video tabs non-active, which don't fully load until I look at them.
,
Aug 7
Removing Needs-Bisect label as the issue is not reproducible from TE-end and requesting yhirano@ for further inputs on this issue as per comment #10 and #11. Thanks...!!
,
Aug 7
+1 to close this bug. We're very appreciating your bug report, but please not that the feature is under development. As toyoshim@ said, it is somewhat broken and the effect may persist. I think it's good to test the feature with Canary as it contains newer changes and it's (probably) isolated from your daily use.
,
Aug 7
But this under development feature has to be *ON* for YouTube to work for me. The old, still-inside-blink CORS isn't working for me. Also, isn't the point of stable chrome having experiments which can be enabled with chrome://flags so that end users can report bugs on them?
,
Aug 7
If YouTube doesn't work in the stable environment (with no experimental flags on), that is likely a Chrome (or YouTube) bug. Please file a bug. > Also, isn't the point of stable chrome having experiments which can be enabled with chrome://flags so that end users can report bugs on them? That depends on the development stage of a feature. For matured features close to shipping, Bug reports like "This feature breaks that site" are very valuable. Out-of-blink CORS on M68 is not on that stage, there are many missing features.
,
Aug 7
marking as WontFix per comment #13 |
||||||||
►
Sign in to add a comment |
||||||||
Comment 1 by swarnasree.mukkala@chromium.org
, Aug 3