title: How to stop CORB from blocking requests to data resources that respond with CORS headers?
body: <p>I am developing a Chrome extension which makes requests from certain websites to an API I control. Until Chrome 73, the extension worked correctly. After upgrading to Chrome 73, I started getting the following error:</p>
  
  <blockquote>
    <p>Cross-Origin Read Blocking (CORB) blocked cross origin response
    <a href="http://localhost:3000/api/users/1" rel="noreferrer">http://localhost:3000/api/users/1</a> with MIME type application/json</p>
  </blockquote>
  
  <p>According to <a href="https://developers.google.com/web/updates/2018/07/site-isolation" rel="noreferrer">Chrome's documentation on CORB</a>, CORB will block the response of a request if all of the following are true:</p>
  
  <ol>
  <li><p>The resource is a "data resource". Specifically, the content type is HTML, XML, JSON</p></li>
  <li><p>The server responds with an <code>X-Content-Type-Options: nosniff</code> header, or if this header is omitted, Chrome detects the content type is one of HTML, XML, or JSON from inspecting the file</p></li>
  <li><p>CORS does not explicitly allow access to the resource</p></li>
  </ol>
  
  <p>Also, according to <a href="https://youtu.be/dBuykrdhK-A?t=1563" rel="noreferrer">"Lessons from Spectre and Meltdown" (Google I/O 2018)</a>, it seems like it may be important to add <code>mode: cors</code> to <code>fetch</code> invocations, i.e., <code>fetch(url, { mode: 'cors' })</code>. </p>
  
  <p>To try to fix this, I made the following changes:</p>
  
  <p>First, I added the following headers to all responses from my API:</p>
  
  <pre><code>Access-Control-Allow-Credentials: true
  Access-Control-Allow-Headers: Content-Type
  Access-Control-Allow-Methods: GET, POST
  Access-Control-Allow-Origin: https://www.example.com
  </code></pre>
  
  <p>Second, I updated my <code>fetch()</code> invocation on the extension to look like this:</p>
  
  <pre><code>fetch(url, { credentials: 'include', mode: 'cors' })
  </code></pre>
  
  <p>However, these changes didn't work. What can I change to make my request not be blocked by CORB?</p>