Origin null is not allowed , XHR Error with Cordova on mobile

I know this Bug has been reported a few times, but there isn’t a real solution provided which works.

BUG: Origin null is not allowed by Access-Control-Allow-Origin.

Setup: Cordova 6.5.0 WkWebView Plugin Sentry Server Hosted Sentry Server allowed domains are set to * RavenJS 3.14.2

The Request in Curl:

curl 'https://sentry.io/api/XXXXXX/store/?sentry_client=raven-js%2F3.14.2&sentry_key=XXXXX&sentry_version=7' \
-XPOST \
-H 'Content-Type: text/plain;charset=UTF-8' \
-H 'Accept: */*' \
-H 'User-Agent: Mozilla/5.0 XXXXXX' \
-H 'Origin: null' \
--data-binary '{"project":"162985","logger":"javascript","platform":"javascript","request":{"headers":{"User-Agent":"Mozilla/5.0 XXXXX Browser"},"url":"file:///var/containers/Bundle/Application/XXXXX.app/www/index.html#/?_k=ljy9kz"},"exception":{"values":[{"type":"Error","value":"There was an error: 0.5179837562765125","stacktrace":{"frames":[{"lineno":null,"colno":null,"function":"dispatchEvent","in_app":true},{"filename":"app.js","lineno":75908,"colno":34,"function":"dispatchEvent","in_app":true},{"filename":"app.js","lineno":80514,"colno":24,"function":"perform","in_app":true},{"filename":"app.js","lineno":75833,"colno":39,"function":"handleTopLevelImpl","in_app":true},{"filename":"app.js","lineno":75750,"colno":25,"function":"handleTopLevel","in_app":true},{"filename":"app.js","lineno":75739,"colno":35,"function":"runEventQueueInBatch","in_app":true},{"filename":"app.js","lineno":69800,"colno":25,"function":"processEventQueue","in_app":true},{"filename":"app.js","lineno":81177,"colno":16,"function":"forEachAccumulated","in_app":true},{"lineno":null,"colno":null,"function":"forEach","in_app":true},{"filename":"app.js","lineno":69586,"colno":46,"function":"executeDispatchesAndRelease","in_app":true},{"filename":"app.js","lineno":70196,"colno":20,"function":"executeDispatchesInOrder","in_app":true},{"filename":"app.js","lineno":70173,"colno":42,"function":"executeDispatch","in_app":true},{"filename":"app.js","lineno":75665,"colno":9,"function":"invokeGuardedCallback","in_app":true},{"filename":"app.js","lineno":117956,"colno":24,"function":"throwError","in_app":true}]}}]},"extra":{"session:duration":3225},"user":{"email":"XXX","id":"-XXX"},"environment":"production","release":"0.1.1","event_id":"XXX"}'

Is there any way to fix this or do some kind of workaround? I have already rewritten the transport function to be able to test more options (even with window.fetch). It won’t work.

Edit: It looks like there is something wrong with WkWebView basically, because the origin shouldn’t be null. But sentry should be able to handle that, or am i missing some security problems?

Greets Marcus

[stripathix]

This makes it work in Cordova:

Raven.config(<dsn including secret key>, { allowSecretKey: true });

[LewisJEllis]

Have you tried using allowSecretKey and your secret DSN?

We note in our raven-js config docs:

if you are using Raven.js in an environment like React Native or Electron, where your application is running “natively” on a device and not accessed at a web address, you may need to use your secret DSN string. To do so, set allowSecretKey: true during configuration.

Try:

Raven.config(<dsn including secret key>, { allowSecretKey: true });

This will stop the sentry backend from doing the CORS validation.