CDN Cname Cross domain issue in jwplayer caption

Question

I am using Jwplayer 6.8 and having my jwplayer setup in some server www.example.com.I am loading subtitles in vtt format from CDN d2cdnserver.cloudfront.com( cname - example.ama

Answer 1

Thanks for commenting on my question for help.

I'll take a blind stab in the dark here, just at your CORS configuration. I'm not exactly sure how CNAME alias changes anything. So forgive me, as I'm not familiar with jwplayer too.

This is your current CORS Policy configuration:

<CORSConfiguration>  
   <CORSRule>    
       <AllowedOrigin>http://*.example.com</AllowedOrigin>
       <AllowedMethod>PUT</AllowedMethod>    
       <AllowedMethod>POST</AllowedMethod>    
       <AllowedMethod>DELETE</AllowedMethod>

       <AllowedHeader>*</AllowedHeader>  
   </CORSRule>  

   <CORSRule>
     <AllowedOrigin>*</AllowedOrigin>    
     <AllowedMethod>GET</AllowedMethod> 
   </CORSRule> 
</CORSConfiguration>

The probable errors I see is in the first <CORSRULE> group.

The first <AllowedOrigin> should be the website that is accessing your bucket resources. For example, if you're on website http://domain1.example.com to access your bucket (Shouldn't matter whether it is CNAME or not). Set both origins as the request's source:

<AllowedOrigin>http://example.com</AllowedOrigin>
<AllowedOrigin>http://*.example.com</AllowedOrigin>

Second issue is your <AllowedMethod>. You should find out from a browser's developer panel (I'm not sure whether jwplayer hides the requests) about the type of HTTP requests jwplayer sends to your S3 bucket server. Most likely it should be HTTP GET. Therefore, you need this line in your first <CORSRule> group:

<AllowedMethod>GET</AllowedMethod>

Third, let's look at your HTTP Headers that jwplayer sends to the server. The first try at <AllowedHeader> you put Authorization first, but you should check in the browser's developer panel on what type of HTTP Header it is firing at the server. Try this first with only:

<AllowedHeader>*</AllowedHeader>

As I noted in my answer from the other question that <AllowedOrigin>*</AllowedOrigin> is not allowed and ignored in CORS the settings.

So, those settings you've set with * only, do try to set it more specific if it doesn't work the first time round e.g. Content-*

I hope I had helped a little without causing further confusion. Good luck.