Nrthugu

I encountered the same error when making an XHR request against a file in Amazon S3. On Safari 7 it was failing. I know you're not using Amazon S3, but I thought I'd post in case this solution helped others.

The problem was that Safari 7 set the Access-Control-Request-Headers header to "origin, x-requested-with", but my AWS CORS configuration only allowed "x-requested-with":

<?xml version="1.0" encoding="UTF-8"?>

<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">

    <CORSRule>

        <AllowedOrigin>*</AllowedOrigin>

        <AllowedMethod>GET</AllowedMethod>

        <MaxAgeSeconds>3000</MaxAgeSeconds>

        <AllowedHeader>Authorization</AllowedHeader>

        <AllowedHeader>x-requested-with</AllowedHeader>

    </CORSRule>

</CORSConfiguration>

I added "origin" as an allowed header and everything worked fine.

        <AllowedHeader>origin</AllowedHeader>

Note: the AllowedOrigin of * is for development purposes only. See @andes comment below for more information.

I just had a similar problem, CORS error. It would work in Firefox & Chrome but not Safari 10.

Turned out we needed to put the trailing slash on the JSON URL.

For CORS request you should be using your origin fflog.storage.googleapis.com. If you use common storage.googleapis.com origin, any site can access to your bucket.

have try try remove overrideMimeType? If you set mime type, it will return correctly.

I also have problem with Safari POST request, but no answer yet. GET is OK.

try to remove overide mimetype.

 var

 jsonhandler=function(){var req=JSON.parse(this.response);console.log(req)},

 req=new XMLHttpRequest;

 req.open('GET','https://storage.googleapis.com/fflog/135172watersupplies_json');

 req.setRequestHeader('Authorization','Bearer '+accessToken);

 req.onload=jsonhandler;

 req.send();

When I query your URL I'm getting back the following Access-Control headers:

Access-Control-Allow-Origin: *

Access-Control-Expose-Headers: Authorization, Cache-Control, Content-Length, Date, Expires, Server, Transfer-Encoding, x-goog-meta-foo1

I suspect it has something to do with your Access-Control headers - either you're leaving something out, or being too specific.

Given that you're actually sending a custom header, you may want to try:

Access-Control-Allow-Headers: *

You could also see if leaving out Access-Control-Expose-Headers makes a difference.

Beyond that, it would actually be helpful to see the actual request / response headers.

When I try

curl -v -X OPTIONS 

  -H 'Origin: fflog.storage.googleapis.com' 

  -H 'Access-Control-Request-Method: GET'  

  https://storage.googleapis.com/fflog/135172watersupplies_json

I get, among other headers:

Access-Control-Allow-Origin: *

When I execute AJAX requests against https://storage.googleapis.com/fflog/135172watersupplies_json from Safari 6.0.4 on Mac OS 10.8.3 I get 403 errors, but they do all execute.

So I can only guess that you are trying to send a credentialed request for which a wildcard Access-Control-Allow-Origin is not allowed.

As for Amazon S3, it only worked in safari after I added more allowed headers, Content-Type and Range. One of these did the job.

<?xml version="1.0" encoding="UTF-8"?>

<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">

    <CORSRule>

        <AllowedOrigin>*</AllowedOrigin>

        <AllowedMethod>GET</AllowedMethod>

        <AllowedMethod>POST</AllowedMethod>

        <MaxAgeSeconds>3000</MaxAgeSeconds>

        <AllowedHeader>Authorization</AllowedHeader>

        <AllowedHeader>Origin</AllowedHeader>

        <AllowedHeader>X-Requested-With</AllowedHeader>

        <AllowedHeader>Content-Type</AllowedHeader>

        <AllowedHeader>Range</AllowedHeader>

    </CORSRule>

</CORSConfiguration>

I had the same problem where CORS worked in Chrome, but threw an origin error in Safari. Turned out it was a Kerberos authorization issue. When I loaded the XHR URL directly in Safari, I was prompted for credentials. After entering them, I returned to the original site, and Safari no longer had the CORS error.

In my case, it was an issue for Accept-Langauge header. I have added Accept-Language inside Access-Control-Allow-Headers and it got resolved.