Firefox Ajax cross origin problem when navigating Confluence

[Galli, Antonio G]

As Enterprise Mobility we have just moved from the server to the cloud instance of Confluence.

Yesterday (17th April 2024) everything was working and I had no problem using confluence with Firefox.

Today I get a ton of :

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://confluence-v1.prod.atl-paas.net/  (Reason: CORS request did not succeed). Status code: (null).

I can see the reason why this happens as the above url is (obviously) the url I am using to access confluence (xxxxxxxx.atalassian.net)

I would like to understand why this is happening and if it is an administrative problem - so I need to check within my company) or it is an Atalassian problem so my company needs to raise a ticket.

[Shawn Doyle - ReleaseTEAM]

CORS errors are thrown when a web request is made in the browser to an endpoint on a domain that is different from the domain of the webpage making the request.  The Atlassian front end is calling something on a different domain, could be due to an addon or feature recently enabled.

However, it could also be a bad cert, a local policy or just how the browser wants to handle this today.

It looks like you are running Datacenter? since the URL you gave is not from Atlassian's Cloud.

If you are running datacenter in AWS, you need to set up the CORS for S3,  https://docs.aws.amazon.com/AmazonS3/latest/userguide/cors.html

Troubleshooting steps

If you added a new addon recently, disable it, if you recently turned on databases or Automation, turn them off.  

Try from different browsers, different computers and then with incognito mode.

If none of those fix it or shed more light on the problem. Check with your IT support team if the are blocking or have set up any new CORS policies.

If all that come up nil, then put in a support ticket with Atlassian.

Good luck there is a lot to look at.

[Jim Knepley - ReleaseTEAM]

I wonder if the request to atl-paas.net is something other than a GET request since that URL responds with

Access-Control-Allow-Methods: GET

CORS interactions include a "pre-flight" request that makes an OPTIONS request to the URL. As OPTIONS isn't an allowed method, that could break the flow.

MarkMonitor owns the atl-paas.net domain, I would see if they can be of any help.