Something appears to be wrong with the implementation of the HTTPS Everywhere extension for Chrome. It is preventing me from using sites that use AJAX to load content. For instance, if I try to use any site that has a Zendesk help desk app integrated to their site.

When I look in the console, I see this error every time:

The 'Access-Control-Allow-Origin' header has a value that is not equal to the supplied origin

I love this extension in general but this is pretty annoying. Any ideas what could be causing this and how to fix it without disabling the extension entirely?


The extension is not broken, its doing exactly what its supposed to do, but the website has probably not been written or tested in an HTTPS environment. The Access-Control-Allow-Origin headers is part of the CORS specification. It allows a website to tell the browser which servers the website is expecting to communicate with. I'm guessing the site is sending something like this:

Access-Control-Allow-Origin: http://foo.example

instead of:

Access-Control-Allow-Origin: https://foo.example

So the extension is trying to force all connections to go over HTTPS, but the requests are being blocked because only HTTP requests are allowed by the CORS policy.

| improve this answer | |
  • Too bad we can't add exclusions for certain sites. – EcomEvo Mar 18 '16 at 20:03
  • Look at Exclusions in the ruleset. Also, you may want to follow this bug. The other thing I would do is contact the website owner, they should really be the ones that fix this. – heavyd Mar 18 '16 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.