AWS The Cross-Origin-Opener-Policy header has been ignored, because the URL's origin was untrustworthy

Viewed 467

I have started a django app on an EC2 instance and I have added my static files(css, js, etc) onto a S3 bucket. After many hours last night I managed to get the static inages to load onto the pages when i viewed the EC2 public address Happy days.

But now i keep getting this error: I keep getting this error when i view inspect a web page "The Cross-Origin-Opener-Policy header has been ignored, because the URL's origin was untrustworthy. It was defined either in the final response or a redirect. Please deliver the response using the HTTPS protocol. You can also use the 'localhost' origin instead"

And none of my static images are loading. I can't find anything online related to this exact error message, there are some variants which lead to dead ends. does anyone know what is going on?

Whats weird is if i run my django app on my personal pc, then the error does not show when i inspect BUT the static images also do not load.

When i run the django app on the ec2 instance, then I get the error message with the static images still not loading. So i dont think the error is affecting the static images from loading, i.e they're 2 separate issues.

But last night all of this was working so i dunno whats happened.

1 Answers

One of the serious bugs I have ever encountered. I got it solved by adding the following setting in your setting.py
SECURE_CROSS_ORIGIN_OPENER_POLICY=None https://django.readthedocs.io/en/stable/ref/settings.html#std-setting-SECURE_CROSS_ORIGIN_OPENER_POLICY

Why did I do that? because the default setting of same origin generated that error persistently. But I know it’s a security concern and perhaps someone who has done system security can give further advice.

Then you if you are not sone yet with your troubles as I was, you probably will have db connection issues, i.e, no error thrown but somehow the app does not connect. reading the docs, django recommends turning
SESSION_COOKIE_SECURE=False
Hopefully it works for you.

Related