0

I have been working on a personal project for a while now and during a testing phase for a database, it began reporting that CORS was preventing the file from being fetched, and stopped my testing in its tracks.

The exact error is as follows:

Access to fetch at 'C:\Users\---\Desktop\Test Files\testing.csv' from origin 'null' has been blocked by CORS policy: Cross origin requests are only supported for protocol schemes: chrome, chrome-extension, chrome-untrusted, data, http, https, isolated-app.

Just to be clear, every single file related to this project is held in the same directory and within the same folder on my computer. None of this is running through the web and every resource this project uses can be found in the same file path. I am not running any kind of server for this testing, I am directly opening everything through an HTML fileset into my Google Chrome browser.

To try and fetch the file, I am using the JS fetch() command, as follows:

const response = await fetch('testing.csv');

From what I understand the fetch() command is allowed by the CORS policy, which confuses me why I'm getting this error. Additionally, if these files all have the same origin pathway, why is CORS even getting triggered in the first place? (The 'fetch' portion of my code is no more complex than that single line. Yes I know this could be the issue but i don't understand why, if it is.)

Additional note: I have already tried to use several other solutions. This includes a snippet of JS to clarify filepath and route it through the HTML, as well as several extensions that promised to "bypass" and/or "disable" CORS for websites. These are all solutions I have found through other posts on StackOverflow, and none of them have worked. There is a chance I messed up during implementation, but right now I'm just trying to understand exactly why CORS working this way moreso than I am interested in a solution.

Improve this question
1
  • I believe the main difference between that post and this post is that I was moreso seeking to learn about CORS and Same Origin Policy directly instead of looking for a direct solution. Additionally their issue is working with JSONLoader from LangChain and 3D models which I believe differs enough from my simple CSV file to be a different use case. I may be wrong, but I'm a mechanic not a software engineer, so I am pretty stupid Commented Oct 23 at 8:32

1 Answer 1

Reset to default
7

Why does CORS apply to local files?

It doesn't. The Same Origin Policy does. CORS is a way to turn the Same Origin Policy off and is only supported via HTTP.

As for a reason, consider this scenario:

Someone emails their target an HTML document. The target double clicks the attachment to open it. It opens in their browser. It's HTML, it is a document, it is harmless, isn't it?

Yes, it is harmless, but only because the Same Origin Policy prevents any JavaScript embedded in the file from accessing the target's disk and sending their personal data to the attacker using fetch.

From what I understand the fetch() command is allowed by the CORS policy

You don't have an HTTP server. There is no CORS policy.

Additionally, if these files all have the same origin pathway

Local files have the origin null which isn't an origin, it is a lack of one. You need HTTP to have an origin.

And is there a way to just disable it?

Not really. Some browsers let you disable the Same Origin Policy in their configuration or with command line switches, but that leaves you running a browser vulnerable to cross origin attacks.

Use a local HTTP server or an application wrapper like Electron to host your files.

Improve this answer
Sign up to request clarification or add additional context in comments.

1 Comment

Thank you for the information! This is already far more information than I've found online, likely because almost everything related to CORS error codes is talking about server related issues. Although it still seems strange to me that there's no local-only bypass. As in, some system that when enabled, can recognize the files are offline, and only allow access to pull other files from the same offline source. Maybe that's just wishful thinking on my part. I'll look at getting an HTTP server set up. Really hoped I didn't have to work with one on this but better than Electron. Thank you!!!

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.