[tor-bugs] #32255 [Applications/Tor Browser]: Missing ORIGIN header breaks CORS in Tor Browser 9.0

[Tor Bug Tracker & Wiki]

#32255: Missing ORIGIN header breaks CORS in Tor Browser 9.0
-------------------------------------------------+-------------------------
 Reporter:  complexparadox                       |          Owner:  tbb-
                                                 |  team
     Type:  defect                               |         Status:  new
 Priority:  Medium                               |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  tbb-9.0-issues, tbb-9.0.1-can, tbb-  |  Actual Points:
  regression, TorBrowserTeam201911               |
Parent ID:                                       |         Points:  2
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by sega01):

 Replying to [comment:10 gk]:
 > Replying to [comment:9 sega01]:
 > > This is breaking
 doublemixwcfx4wadeuvuygpxej5jpu7uleesh3yptopnbj5kshnlrid.onion for me.
 > >
 > > Do you know of any workarounds?
 >
 > What does break mean? I just loaded the .onion and it works fine for me.

 Try to do a mix and watch the network tab. It will retry OPTIONS over and
 over. Just enter a Bitcoin address like 1xm4vFerV3pSgvBFkyzLgT1Ew3HQYrS1V
 and click on mix.

 The Bitmix API requires the Origin header to return the correct CORS
 response. Foxmixer is fine because it returns for *. Bitmix is selective.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/32255#comment:11>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online