Chrome扩展程序20小时后没有“Access-Control-Allow-Origin”标题

Question

I use chrome.identity.getAuthToken to talk to some internal API. Everything is perfect for the first 20 hours, I can call the API and get what I need.

After ~20 hours my extension stopped working and I get:

No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin ' https://MY_API ' is therefore not allowed access.

I know that chrome.identity.getAuthToken will renew expired tokens and I can see that at chrome://identity-internals/ , my code gets a new access token but cannot send the request.

If I uninstall / install extension again then it's working again.

Manifest contains:

"permissions": [ "tabs", "activeTab", "cookies", "identity", "<all_urls>" ]

What happens when I re-install my extension that makes the bug go away?

background.js:

    chrome.identity.getAuthToken({interactive: true}, function(token) {

        gapi.auth.setToken({'access_token': token});

        // Load the storage API.
        gapi.client.load(API_ROOT + DISCOVERY_PATH,
            VERSION, function() {
          // Initialize GAPI's OAuth.
          gapi.auth.init(function() {
            var request = "It's request to my API";

            // Not working after 20 hours
            request.execute(function(response) {
             // do something
            });

          });
        });
      })

Also tried to call "chrome.identity.removeCachedAuthToken" but extension stopped working in 20 hours.

Answer 1

on server " https://MY_API " set this settings:

Header always append X-Frame-Options SAMEORIGIN
Header add Access-Control-Allow-Origin "*"

in .htaccess or httpd.conf (if server is httpd/apache)

Answer 2

When you uninstall/reinstall the extension, its internal state is completely wiped; this makes your code get a completely fresh token, not refresh a previously-obtained one.

As for Access-Control-Allow-Origin header - this is a server-side response header, and we can only guess why this changes for some random 3rd-party API (that you didn't even name). A reasonable guess is that you're hitting some rate-limiting or quota, though it's very strange to use CORS for that.

This particular error can be brushed aside permanently by requesting cross-origin permissions , which makes Chrome ignore CORS for requests from the extension (including content scripts). However, you should double-check usage terms of the API, if any.