title: CORS https access to localhost works on Chrome but NOT on Firefox
body: <p>I am running into a CORS issue on firefox and IE while Chrome seems to handle the same scenario just fine.</p>
  
  <p>I have a requirement to access a local mongoose server from a web app running in the browser. I send XMLHTTP request from my web app which is a Google App Script - HTMLService (that is served from <code>https://script.google.com</code> ) to local client that is running a mongoose server running on localhost - 127.0.0.1:1234 . The XMLHTTP request is sent to</p>
  
  <pre><code>https://localhost:1234/ping
  </code></pre>
  
  <p>over HTTPS (GET). The server should respond with "PING_OK" message as plain text.
  We also point the browser to </p>
  
  <pre><code>https://localhost:1234/ping
  </code></pre>
  
  <p>to have our test certificated accepted as a trusted source.
  After the above steps, Chrome browser is able to access the local mongoose server, but Firefox fails with the message <strong>"NS_ERROR_DOM_BAD_URI: Access to restricted URI denied"</strong> (IE also fails)</p>
  
  <p>Also a test html page when served from <code>file:///c:test.html</code> is also able to access </p>
  
  <pre><code>https://localhost:1234/ping
  </code></pre>
  
  <p>via Firefox and Chrome.</p>
  
  <p>Here is the javascript in the html :</p>
  
  <pre><code>  var xmlhttp;
    if (window.XMLHttpRequest) {
      // code for IE7+, Firefox, Chrome, Opera, Safari
      xmlhttp=new XMLHttpRequest();
    }
    else {
      // code for IE6, IE5
      xmlhttp=new ActiveXObject('Microsoft.XMLHTTP');
    }
  
  
    //  set the onreadystatechange callback
    xmlhttp.onreadystatechange = function() {
      var xStatus = ['UNSENT','OPENED','HEADERS_RECEIVED','LOADING','DONE'];
      if (xmlhttp.readyState==4 &amp;&amp; xmlhttp.status==200) {
          var response =  xmlhttp.responseText;
          console.log('Response: '+response);
      } else if((xmlhttp.readyState&gt;0) &amp;&amp; (xmlhttp.readyState&lt;4)){
          console.log('state='+ xStatus[xmlhttp.readyState]+', status='+ xmlhttp.statusText);
      } else {
          console.log('state='+ xStatus[xmlhttp.readyState]+', status='+ xmlhttp.statusText);
        }
    }
  
  
    //  set the timeout value and the ontimeout callback
  
    xmlhttp.timeout = 30000;
    xmlhttp.ontimeout = function() {
         console.log('XHR timed out');
    }
  
    var url = 'https://localhost:1234/ping';
    var params = '';
  
  
    xmlhttp.open('POST', url, true);
    xmlhttp.send(params);
  </code></pre>
  
  <p>The server certificate is a test certificate generated with openSSL for ""OTHER" ( Mongoose-c++) and set with the following options.</p>
  
  <p>Here is the code on the mongoose server side on the local machine.</p>
  
  <pre><code>void FakeWebServer::handlePingRequest(struct mg_connection *conn) {
  
  /// Set headers
  mg_send_header(conn, "Access-Control-Allow-Origin", "*");
  mg_send_header(conn, "Access-Control-Allow-Methods", "POST, GET, OPTIONS");
  mg_send_header(conn, "Access-Control-Allow-Headers", "X-PINGOTHER");
  mg_send_header(conn, "Access-Control-Max-Age", "1728000");
  
  mg_send_header(conn, "Content-Type", "text/plain");
  
  /// Send Fake Message
  std::string msg = "PING_OK";
  mg_send_data(conn, msg.c_str(), strlen(msg.c_str()));
  }
  </code></pre>
  
  <p>The above code when deployed as a webapp via google app scripy happily works in Chrome but Firefox fails with "NS_ERROR_DOM_BAD_URI: Access to restricted URI denied"</p>
  
  <p>I am relatively new to javascript programming and I am not sure if this is an SSL related issue I am facing or a CORS one...</p>
  
  <p>1) Am I missing any additional parameters or config in this kind of ssl access on either end?</p>
  
  <p>2) Also why would a page served from  file:///*html be able to access </p>
  
  <pre><code>https://localhost:1234
  </code></pre>
  
  <p>via CORS while the exact same html when served from </p>
  
  <pre><code>https://script.google.com
  </code></pre>
  
  <p>fail on Firefox (and IE).</p>
  
  <p>Any pointers and suggestions to resolve this is much appreciated.</p>