<p>Ok, so after going through the logs in craft/storage/runtime I found the problem.</p>

<p>I'm using environment variables for my sites url and had it set to:</p>

<blockquote>
  <p>mysite.com</p>
</blockquote>

<p>However when going to the site using Safari or Firefox it was tacking on the www subdomain so I was actually at www.mysite.com.  I guess according to that CORS thing the subdomain of www didn't have permission to access anything, only the origin of mysite.com did.  </p>

<p>I went ahead and changed my environment variables to:</p>

<blockquote>
  <p>www.mysite.com</p>
</blockquote>

<p>and then created a redirect in my .htaccess file to always point to the www subdomain. I don't know if this is the proper fix but it works! I'm sure theres a way to tell the CORS thing that the www subdomain is an ok guy and can have permission.  I just don't know how.</p>

CC BY-SA 3.0
2018-01-10T20:15:10.173Z
I also had problems with external resources... It's just Firefox and Safari Craft Live Preview. We are running the system currently with a staging subdomain. Does someone has more explanation what could cause this error. The defined policies are working well on the page, its just the preview
Simon Franzen
CC BY-SA 3.0
2016-10-25T18:27:46.230Z
2016-10-25T18:27:46.230Z
Jesse O'Neill
<p>CORS (or Cross-Origin Resource Sharing) issues usually occur when you are attempting to load a resource such as a font, a stylesheet, or a script from a remote location that does not give your domain explicit permission to access it. Thinking the resource is unsafe, your browser will block it.  </p>

<p>Are these pages attempting to load any resources from remote locations such as a CDN or web storage like an S3 bucket? If so, you may need to edit your CORS policy for those services to mark your resources as "safe" for your domain.</p>

CC BY-SA 3.0
2016-10-25T18:21:01.590Z
Ok, so it's basically like a gatekeeper.  And no, don't have any external assets.
Jesse O'Neill
CC BY-SA 3.0
2016-10-25T17:43:52.037Z
2016-10-25T17:43:52.037Z
Leah Scott
<p>New Craft user here and I am working on wrapping up my first Craft site and am running into a Live Preview error.</p>

<p>When Live Preview is activated in either Firefox or Safari, I just get a blank white page and am getting this error thrown in the console:</p>

<blockquote>
  <p>XMLHttpRequest cannot load <a href="http://mysite.com/section/slug" rel="nofollow">http://mysite.com/section/slug</a>. Cross-origin redirection denied by Cross-Origin Resource Sharing policy.</p>
</blockquote>

<p>I'm not really sure what that is other than it sounds like I need to give something access that doesn't have it.   And I'm not sure why this error doesn't get thrown in for Chrome or IE.</p>

<p>Any help would be appreciated!</p>

<live-preview>
Live Preview failing in Safari and Firefox only
# Live Preview failing in Safari and Firefox only

(Asked by: username_0 on 2016-10-25)

New Craft user here and I am working on wrapping up my first Craft site and am running into a Live Preview error.

When Live Preview is activated in either Firefox or Safari, I just get a blank white page and am getting this error thrown in the console:

> XMLHttpRequest cannot load <http://mysite.com/section/slug>. Cross-origin redirection denied by Cross-Origin Resource Sharing policy.

I'm not really sure what that is other than it sounds like I need to give something access that doesn't have it. And I'm not sure why this error doesn't get thrown in for Chrome or IE.

Any help would be appreciated!

**Tags:** live-preview


---

## 2 answers

### Answer by username_0 on 2016-10-25. Score: 3 | Accepted answer

Ok, so after going through the logs in craft/storage/runtime I found the problem.

I'm using environment variables for my sites url and had it set to:

> mysite.com

However when going to the site using Safari or Firefox it was tacking on the www subdomain so I was actually at www.mysite.com. I guess according to that CORS thing the subdomain of www didn't have permission to access anything, only the origin of mysite.com did.

I went ahead and changed my environment variables to:

> www.mysite.com

and then created a redirect in my .htaccess file to always point to the www subdomain. I don't know if this is the proper fix but it works! I'm sure theres a way to tell the CORS thing that the www subdomain is an ok guy and can have permission. I just don't know how.

> **Comments:**
> **username_1**: I also had problems with external resources... It's just Firefox and Safari Craft Live Preview. We are running the system currently with a staging subdomain. Does someone has more explanation what could cause this error. The defined policies are working well on the page, its just the preview  

---

### Answer by username_2 on 2016-10-25. Score: 3

CORS (or Cross-Origin Resource Sharing) issues usually occur when you are attempting to load a resource such as a font, a stylesheet, or a script from a remote location that does not give your domain explicit permission to access it. Thinking the resource is unsafe, your browser will block it.

Are these pages attempting to load any resources from remote locations such as a CDN or web storage like an S3 bucket? If so, you may need to edit your CORS policy for those services to mark your resources as "safe" for your domain.

> **Comments:**
> **username_0**: Ok, so it's basically like a gatekeeper.  And no, don't have any external assets.  

---

