Mintplex-Labs/anything-llm
1
0
Fork 0
mirror of https://github.com/Mintplex-Labs/anything-llm.git synced 2026-07-19 22:23:50 -04:00
Code Issues 328 Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #2561] Chat Widget Issue - CORB #1658

New Issue
Closed
opened 2026-02-22 18:25:55 -05:00 by yindo · 6 comments
yindo commented 2026-02-22 18:25:55 -05:00
Owner
Copy Link
Copy Source

Originally created by @KJOB830 on GitHub (Oct 31, 2024).
Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/2561

Context:

  1. Hosted on local docker, tunnelled using Ngrok for the website(vercel.app) chat widget. (works locally on my pc, ngrok domain can be access properly)
  2. Have been receiving CORS error so i setup CORS to allow the Vercel Domain, still error but now CORB.
  3. I do not know what else could be causing this aside from the content header types.

in Postman
http://ngrok(or)localhost:3001/embed/anythingllm-chat-widget.min.js

This will show the content-type as text/html instead of I THINK text/javascript or something. i really do not know anymore

Originally created by @KJOB830 on GitHub (Oct 31, 2024). Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/2561 Context: 1. Hosted on local docker, tunnelled using Ngrok for the website(vercel.app) chat widget. (works locally on my pc, ngrok domain can be access properly) 2. Have been receiving CORS error so i setup CORS to allow the Vercel Domain, still error but now CORB. 3. I do not know what else could be causing this aside from the content header types. > in Postman `http://ngrok(or)localhost:3001/embed/anythingllm-chat-widget.min.js` This will show the content-type as `text/html` instead of I THINK `text/javascript` or something. i really do not know anymore
yindo closed this issue 2026-02-22 18:25:55 -05:00
yindo commented 2026-02-22 18:25:55 -05:00
Author
Owner
Copy Link
Copy Source

@timothycarambat commented on GitHub (Oct 31, 2024):

You are correct that application/javascript should be the Content-Type header. The MIME's wont match and Chrome may fail to render if the type is anything else. How did you set up the vercel domain because it is surely related to that.

@timothycarambat commented on GitHub (Oct 31, 2024): You are correct that `application/javascript` should be the `Content-Type` header. The MIME's wont match and Chrome may fail to render if the type is anything else. How did you set up the vercel domain because it is surely related to that.
yindo commented 2026-02-22 18:25:55 -05:00
Author
Owner
Copy Link
Copy Source

@KJOB830 commented on GitHub (Oct 31, 2024):

pasted the chat embed script tag with defer on the layout for the website.

Current anythingllm image is built from source, i modified the server file to use cors with domain of my vercel website. I also added the vercel website on chat embeds domain restriction so it should only accept requests from that. Tested on postman the CORS origin shows my vercel websites domain. But still CORB, so now i just think its the content types mismatch

Additionally i tried to use api embed something so it looks like the fetch is coming from my Vercels domain instead of Ngrok tunnel (cause browsers dont like third party stuff anymore if i read right)

@KJOB830 commented on GitHub (Oct 31, 2024): > pasted the chat embed script tag with defer on the layout for the website. > Current anythingllm image is built from source, i modified the server file to use cors with domain of my vercel website. I also added the vercel website on chat embeds domain restriction so it should only accept requests from that. Tested on postman the CORS origin shows my vercel websites domain. But still CORB, so now i just think its the content types mismatch > Additionally i tried to use api embed something so it looks like the fetch is coming from my Vercels domain instead of Ngrok tunnel (cause browsers dont like third party stuff anymore if i read right)
yindo commented 2026-02-22 18:25:55 -05:00
Author
Owner
Copy Link
Copy Source

@timothycarambat commented on GitHub (Oct 31, 2024):

If you copy the min.js file directly from AnythingLLM and put it local to the site to it is no longer cross-origin - do you still have this issue? The js file is served from AnythingLLM by default since that is easier, but you could take the raw file and host it anywhere

@timothycarambat commented on GitHub (Oct 31, 2024): If you copy the `min.js` file directly from AnythingLLM and put it local to the site to it is no longer cross-origin - do you still have this issue? The js file is served from AnythingLLM by default since that is easier, but you could take the raw file and host it anywhere
yindo commented 2026-02-22 18:25:55 -05:00
Author
Owner
Copy Link
Copy Source

@KJOB830 commented on GitHub (Nov 6, 2024):

I know its closed but i wanna give an Update.

Changed tunnelling service to serveo instead of ngrok, it worked.
After all this failed reverse proxy and custom headers with ngrok -_-

@KJOB830 commented on GitHub (Nov 6, 2024): I know its closed but i wanna give an Update. Changed tunnelling service to serveo instead of ngrok, it worked. After all this failed reverse proxy and custom headers with ngrok -_-
yindo commented 2026-02-22 18:25:55 -05:00
Author
Owner
Copy Link
Copy Source

@timothycarambat commented on GitHub (Nov 6, 2024):

??? I wonder why that worked. I know NGROK has some options for --request-header - maybe more config on that would have been a resolution?

@timothycarambat commented on GitHub (Nov 6, 2024): ??? I wonder why that worked. I know NGROK has some options for [`--request-header`](https://ngrok.com/docs/http/request-headers/) - maybe more config on that would have been a resolution?
yindo commented 2026-02-22 18:25:55 -05:00
Author
Owner
Copy Link
Copy Source

@KJOB830 commented on GitHub (Nov 6, 2024):

Ngrok imposes a browser warning page when new connections attempt to access the upstream server. This page requires users to confirm they understand they are connecting to an Ngrok domain, resulting in unexpected behavior when using Ngrok to host a chatbot widget. Specifically, each time the Vercel-hosted website requests JavaScript or CSS files required for the widget, Ngrok returns the warning page instead of the expected resources. This discrepancy causes Cross-Origin Read Blocking (CORB) issues, as the returned headers do not align with the anticipated ones.

To address this, the "ngrok-skip-browser-warning" custom header was added in several configurations: first in the Ngrok web interface's edge settings, and later in Vercel’s fetch requests to manage CORS for the Ngrok domain. The header appeared correctly in Postman tests; however, the warning page continued to appear inconsistently. Additionally, attempts were made to modify the server file source code to include this custom header and rebuild the Docker image to bypass the warning, but this also proved ineffective. Info

As a temporary solution, Servio was used, though a more stable configuration is planned for hosting the AnythingLLM instance. Efforts will also continue to refine Ngrok for static domain requests.

This turnabout ways could've been skipped if i was willing to pay $18 to ngrok

@KJOB830 commented on GitHub (Nov 6, 2024): Ngrok imposes a browser warning page when new connections attempt to access the upstream server. This page requires users to confirm they understand they are connecting to an Ngrok domain, resulting in unexpected behavior when using Ngrok to host a chatbot widget. Specifically, each time the Vercel-hosted website requests JavaScript or CSS files required for the widget, Ngrok returns the warning page instead of the expected resources. This discrepancy causes Cross-Origin Read Blocking (CORB) issues, as the returned headers do not align with the anticipated ones. To address this, the "ngrok-skip-browser-warning" custom header was added in several configurations: first in the Ngrok web interface's edge settings, and later in Vercel’s fetch requests to manage CORS for the Ngrok domain. The header appeared correctly in Postman tests; however, the warning page continued to appear inconsistently. Additionally, attempts were made to modify the server file source code to include this custom header and rebuild the Docker image to bypass the warning, but this also proved ineffective. [Info](https://stackoverflow.com/questions/73017353/how-to-bypass-ngrok-browser-warning#:~:text=PM%20from%20ngrok,at%207%3A43) As a temporary solution, Servio was used, though a more stable configuration is planned for hosting the AnythingLLM instance. Efforts will also continue to refine Ngrok for static domain requests. This turnabout ways could've been skipped if i was willing to pay $18 to ngrok
yindo changed title from Chat Widget Issue - CORB to [GH-ISSUE #2561] Chat Widget Issue - CORB 2026-06-05 14:41:59 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Desktop
Docker
Integration Request
Integration Request
OS: Linux
OS: Mobile
OS: Windows
UI/UX
blocked
bug
bug
core-team-only
documentation
duplicate
embed-widget
enhancement
feature request
github_actions
good first issue
investigating
needs info / can't replicate
possible bug
pull-request
Mirrored from GitHub Pull Request
 question
stage: specifications
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Mintplex-Labs/anything-llm#1658
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?