Cross domain issue found in Wrapper IMA SDK

[Sunil Kumar]

Hi 

I am facing issue of cross domain while testing it from localhost. I am requesting Adtech calls for ads but it is giving me wrapper ads and after parsing it I retrieve below URL and passing it to adsRequest.adTagUrl but it is giving cross domain issue and some time it failed to load and gives error. 

https://imasdk.googleapis.com/js/sdkloader/vpaid_adapter.js?adTagUrl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-video-pub-8609501543919728%26slotname%3D9922539035%26ad_type%3Dvideo%26description_url%3Dhttp%253A%252F%252Fwww.ndtv.com%252Fvideo%252Flive%252Fchannel%252Fndtv24x7%26max_ad_duration%3D15000%26sdmax%3D60000%26videoad_start_delay%3D0&type=all

Please find the attached screenshot for your reference. 

Please advise on this. 

Best regards,

Sunil Kumar

[Vu Chau (IMA SDK Team)]

Hi Sunil,

It looks like the script imasdk.googleapis.com is blocked from being used by your implementation, because the latter is a localhost.  It's a CORS issue, for which we have a section in our docs that should help you address it.

Let me know if that solves the issue,

Vu Chau

IMA SDK Team

[Sunil Kumar]

Hi Vu Chau,

Thanks a lot for your kind support. I have checked  document and found google IMA SDK URL has not set CORS at their end. This is suppose to be done at server side at below mention URL which I am loading in my player to play ads. 

Can you please review below scenario and advise us how to solve this problem? 

I am requesting URL - "https://ima3vpaid.appspot.com/?adTagUrl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-video-pub-8609501543919728%26slotname%3D9922539035%26ad_type%3Dvideo%26description_url%3Dhttp%253A%252F%252Fwww.ndtv.com%252Fvideo%252Flive%252Fchannel%252Fndtv24x7%26max_ad_duration%3D15000%26sdmax%3D60000%26videoad_start_delay%3D0&type=all"  and receiving two types of ADS i.e. one is for Flash Player and another one is for JavaScript file. 

Here I need only JavaScript file to play ads in my IMA SDK in HTML5 player. But the above URL is working fine and giving all access and showing all controls in Response Header. 

1. Successfully found - access-control-allow-credentials:
   true
2. Successfully found -
   access-control-allow-origin:
   *

 But when I load below URL in my IMA SDK it is giving me error of cross domain. 

Error - 304 no Response header set - 

1. Not found - access-control-allow-credentials:
   true
2. Not found -
   access-control-allow-origin:
   *
3. https://imasdk.googleapis.com/js/sdkloader/vpaid_adapter.js?adTagUrl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-video-pub-8609501543919728%26slotname%3D9922539035%26ad_type%3Dvideo%26description_url%3Dhttp%253A%252F%252Fwww.ndtv.com%252Fvideo%252Flive%252Fchannel%252Fndtv24x7%26max_ad_duration%3D15000%26sdmax%3D60000%26videoad_start_delay%3D0&type=all
   

Can you please advise what is wrong in my implementation? Also can you please check at your end and see if you can play ads in IMA SDK from above URL which response is 304. If you think that the URLs need to set CORS value please advise to whom should I contact to solve this problem. 

Again thanks a lot for your valuable time to support us. 

Best regards,

Sunil Kumar

[Sunil Kumar]

Continue to my previous message - 

Please find the attached screen shot for your reference and sample URL where you can see the cross domain issue in console log. 

http://drop.ndtv.com/common/testpage/sunil/m.ndtv.com/index.html

Best regards,

Sunil Kumar

[Vu Chau (IMA SDK Team)]

Hi Sunil,

Thanks for the follow-up details.  On the server side, you'll need to set the allow-origin header to a specific domain (i.e. imasdk.googleapis.com) or set the credentials flag to false.  The reason it is failing is because a wildcard "*" is being used in the allow-origin header and the credentials flag is true.  Please make either one of the aforementioned changes and let us know if it rectifies the issue!

Vu Chau

IMA SDK Team

[Sunil Kumar]

Hi Vu Chau,

Thanks a lot for prompt response, I am accessing Google Ima sdk URL and I don't have any control of Google then how can I set allow origin header.

Request you to please advise where and how to set it. I have sent you both URL and it would be better if you review it and help us to solve this issue.

Best regards,
Sunil

[Vu Chau (IMA SDK Team)]

Hi Sunil,

Sorry for the confusion.  So the issue turned out to be because of the wrapper.  The wrappers (https://ima3vpaid.appspot.com and https://imasdk.googleapis.com) here are VPAID adapters, and if you are using IMA already then you don't need the VPAID adapter.  Try testing the direct DFP-hosted tag (https://googleads.g.doubleclick.net/pagead/ads?client=ca-video-pub-8609501543919728&slotname=9922539035&ad_type=video&description_url=http%3A%2F%2Fwww.ndtv.com%2Fvideo%2Flive%2Fchannel%2Fndtv24x7&max_ad_duration=15000&sdmax=60000&videoad_start_delay=0) and let us know if the issue persists.  When you are generating tags on DFP's front end, make sure you are not using any option that'd add ima3vpaid.appspot.com to your tag.  Since you don't need the adapter in an IMA-enabled environment, there is no CORS header present on one of the pages.

Thanks,

Vu Chau

IMA SDK Team

[Sunil Kumar]

Thanks a lot Vu Chau, 

After updating URL its working fine. 

Thanks a lot for your kind support :)

Best regards,

Sunil Kumar