/.well-known/matrix/client redirect without CORS not detected

Matrix Connectivity Tester Support
1

Hello, thanks for the tool.

The hope.net homeserver currently has misconfigured CORS. https://hope.net/.well-known/matrix/client returns a 302 without Access-Control-Allow-Origin: *, which breaks Element desktop, cinny, etc, despite the redirect’s target having correct CORS.

The connectivity tester reports “Client-Server API unavailable” and hints to check CORS for /_matrix/client/versions, but doesn’t hint about about CORS for /.w-k/m/client, which as far as I can tell is the real problem.

I would guess that either:

  • CORS is checked by the server, but only after following the redirect, or
  • Since the in-browser /.w-k/m/client request failed it guesses there’s no delegation, then finds /_matrix/client/versions also broken (CORS and/or 404), so only reports that.
2

Hi :slight_smile:

Indeed that seems to have been an oversight. It should now warn about the missing CORS header for the client well known on Results: hope.net :slight_smile:

3

Excellent, thank you!