如何让谷歌浏览器允许 CORS？

Question

I have the following code on a (IIS) server as test1.htm.

 <script> request = new XMLHttpRequest(); request.open("GET", "http://192.168.1.102/test2.htm", false); request.send(); alert(request.response); </script>

The file test2.htm just contains some simple text, "Hello World". When I navigate Chrome to test1.htm using HTTP, to no surprise I get an alert popup saying, Hello World. Life is good.

However, when I change HTTP to HTTPS for test1.htm, the request to test2.htm initiates a cross-domain violation, which it should.

But, I do have an extension named, "Allow CORS: Access-Control-Allow-Origin" installed and turned on. I'm new to CORS, but my understanding is that Chrome should now initiate a CORS process, perhaps a pre-flight check? I see nothing.

Using the F12 debugger tool, I see that the request for test2.htm is flagged in red and its status marked as "blocked: mixed content", which is what I would expect if I did NOT have the CORS extension. But I do...

What am I missing?

Thanks! Curt

Update: I'm using Chrome version 88.0.4324.190 under Windows 10.

Answer 1

As it turns out that example doesn't just create a cross-domain violation; it also creates a mixed-content violation. That is, mixing http with https. It's also known as insecure content for which there's a site-specific setting within Chrome. Once that is set, the browser then allows the http request, but then expects a "simple" CORS response.