From 6f0326dfc1f20d06fd191dd74b70e7fd642daee4 Mon Sep 17 00:00:00 2001 From: nanocortex <40443396+nanocortex@users.noreply.github.com> Date: Wed, 7 Oct 2026 11:41:07 +0200 Subject: [PATCH] Document CORS_ALLOWED_ORIGINS requirement for MeTube 2026.09.25+ --- README.md | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 8f2f7f8..bf3f563 100644 --- a/README.md +++ b/README.md @@ -33,6 +33,8 @@ See the [CHANGELOG](CHANGELOG.md) for version history and release notes. > **Note**: This extension requires a running [MeTube](https://github.com/alexta69/metube) instance. MeTube is a self-hosted YouTube downloader with a web interface. If you don't have MeTube set up yet, visit the [MeTube project](https://github.com/alexta69/metube) for installation instructions. +> **Important**: MeTube refuses requests from browser extensions unless `CORS_ALLOWED_ORIGINS` is set on your instance (enforced since MeTube 2026.09.25). Set `CORS_ALLOWED_ORIGINS=*` and restart MeTube, see [CORS Configuration](#cors-configuration) and the [MeTube wiki](https://github.com/alexta69/metube/wiki/Sending-links-to-MeTube). + ### Basic Usage 1. Configure your MeTube instance URL in addon preferences (`about:addons` → MeTube Downloader → Options) @@ -141,6 +143,12 @@ This extension requires the following permissions: **Error: "MeTube instance url not configured"** - Go to `about:addons` → MeTube Downloader → Options and enter your MeTube URL +**Nothing happens, or "MeTube refused this request from moz-extension://..." (HTTP 403)** +- Your MeTube instance does not allow requests from the extension. Since MeTube 2026.09.25 this applies to both HTTP and HTTPS instances. +- Set `CORS_ALLOWED_ORIGINS=*` on your MeTube instance and restart it, see [CORS Configuration](#cors-configuration) +- The MeTube container logs show `Refused cross-origin POST /add from moz-extension://...` when this is the cause +- With One-Click Mode enabled the popup does not open, so the error is only visible in the extension console (see [Debugging and Viewing Logs](#debugging-and-viewing-logs)) + **Error: "Connection failed" with HTTP URLs (e.g., `http://server:5510`)** - Firefox HTTPS-Only Mode blocks HTTP requests from extensions ([Firefox bug #1685862](https://bugzilla.mozilla.org/show_bug.cgi?id=1685862)) - **Important**: Site exceptions do NOT work for extension requests - this is a known Firefox limitation @@ -152,7 +160,7 @@ This extension requires the following permissions: **Error: "Connection failed" or CORS errors with HTTPS URLs** - **Missing host permission**: Re-save your settings in addon preferences (`about:addons`) and accept the permission prompt when Firefox asks. This is the most common fix. - **Self-signed certificate**: Visit your MeTube URL in a browser tab first and accept the security warning/certificate -- **CORS not configured**: If re-saving settings doesn't help, set `CORS_ALLOWED_ORIGINS=*` on your MeTube instance — see [CORS Configuration](#cors-configuration) below. +- **CORS not configured**: Set `CORS_ALLOWED_ORIGINS=*` on your MeTube instance, see [CORS Configuration](#cors-configuration) below. - **SSO/Authentication**: Enable "Send cookies for authentication (SSO)" in extension settings (see [Enabling SSO Support](#enabling-sso-support)) **Error: "Authentication failed. Your MeTube instance is redirecting to authentication"** @@ -162,9 +170,9 @@ This extension requires the following permissions: ### CORS Configuration -In most cases, re-saving your addon settings and accepting the permission prompt is enough — Firefox grants the extension direct access to your MeTube instance, bypassing CORS entirely. +**This step is required.** The extension sends requests from its own `moz-extension://` origin, and MeTube refuses cross-origin requests unless their origin is allowed in `CORS_ALLOWED_ORIGINS`. Since MeTube 2026.09.25 this is enforced on the server for every request that queues a download, so granting the extension host permission in Firefox is no longer enough. When the variable is unset or empty, the extension cannot send anything. -If you still get CORS errors after that, you can configure MeTube itself to allow cross-origin requests. Since [MeTube v2025.4.9](https://github.com/alexta69/metube/commit/0072d34), cross-origin requests are denied by default. Set `CORS_ALLOWED_ORIGINS=*` on your MeTube instance (browser extensions use unpredictable `moz-extension://` origins, so `*` is the only viable value). +Set `CORS_ALLOWED_ORIGINS=*` on your MeTube instance and restart it. See also the [MeTube wiki](https://github.com/alexta69/metube/wiki/Sending-links-to-MeTube). **Docker Compose:** ```yaml @@ -180,6 +188,8 @@ services: docker run -e CORS_ALLOWED_ORIGINS=* ghcr.io/alexta69/metube ``` +**Allowing only this extension:** instead of `*` you can list the extension's exact origin, e.g. `CORS_ALLOWED_ORIGINS=moz-extension://`. The UUID is different for every Firefox profile; MeTube logs it on every refused request (`Refused cross-origin POST /add from moz-extension://...`), or find it in `about:debugging` → This Firefox → MeTube Downloader → Internal UUID. Naming the origin explicitly is also what MeTube requires for credentialed requests, so prefer it if your instance sits behind SSO or reverse proxy authentication. + ### Debugging and Viewing Logs To view detailed error messages and logs: