"Download Brackets without Extract" link blocked by HTTPS Everywhere on Firefox

[anewuser]

The "Download Brackets without Extract" link doesn't work for me (Firefox 35.0.1 on Windows). I opened the console and found this:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://s3.amazonaws.com/files.brackets.io/updates/stable/en.json?_=1424389017263. This can be fixed by moving the resource to the same domain or enabling CORS.

[peterflynn]

I suspect that error is unrelated -- clear your console after the page is loaded, then click the button, then see if anything new has appeared in the console. If not, then maybe use the FF dev tools to debug into logAndGo() and see why clicking the link isn't working.

The CORS error is very strange though -- that URL does respond with Access-Control-Allow-Origin: * already (otherwise it wouldn't work in any browser). Do you have any FF extensions installed (adblockers, etc.) that might be affecting this?

[peterflynn]

Hmm that link works for me in Firefox 35.0.1 on Mac -- and I don't see that error in the console either. Maybe try making a clean FF profile (no extensions, empty cache, default settings) and check if you see the same thing there or not.

[anewuser]

I'm sorry for not trying the Firefox "safe mode" before posting here.

This error is indeed caused by an extension: HTTPS-Everywhere. Disabling it makes the download work.

[peterflynn]

Can you use Firefox dev tools to capture a log of the network when loading the page, and then when clicking the button? That should show which request is failing.

[anewuser]

The only error that appears is the one I included in my first post. HTTPS-Everywhere is an extension that redirects requests to domains in a pre-built list to their HTTPS versions. If you want, I can report this to its developers.

[PlanetVaster]

Guess it's solved you should close this now

[peterflynn]

@anewuser Right, but I have no idea which domains are in their whitelist, so I don't know which network requests were modified from what the page was expecting. The Firefox dev tools has a Network tab -- if you open that and then load brackets.io, you should be able to go down the list and see (a) which items were loaded via https:// URLs, and (b) which items had an error or redirect.

[marcelgerber]

I've installed the HTTPS Everywhere extension and actually, the issue is caused by the CORS issue that is also printed to console. The current Brackets Release cannot be determined without downloading the JSON file, so HTTPS Everywhere breaks the website by breaking CORS.

The CORS issue is probably EFForg/https-everywhere#49.

[peterflynn]

@marcelgerber Ah, cool! It didn't even occur to me that the extension could be breaking CORS directly, rather than just changing URLs. Definitely a problem with the extension itself then -- nothing wrong with our page...

[marcelgerber]

Yeah, but I have a fix up (imo a improvement anyway) to fix the extension.