Access to XMLHttpRequest at 'xxx' from origin 'https://imasdk.googleapis.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'xxx' that is not equal to the supplied origin.

[Jeong-Heon Yang]

Hello,

Since yesterday 6:30pm CEST there has been errors on our ad delivery system: 

Access to XMLHttpRequest at 'https://video-ads.rubiconproject.com/video/xxxxx/vast.xml?tg_c.language=' from origin 'https://imasdk.googleapis.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://utip.io' that is not equal to the supplied origin.

We have activated INSECURE MODE with :

google.ima.settings.setVpaidMode(google.ima.ImaSdkSettings.VpaidMode.INSECURE);

and We have even added this 
 // Create ads loader.
adsLoader = new google.ima.AdsLoader(adDisplayContainer);

 adsLoader.getSettings().setVpaidMode(google.ima.ImaSdkSettings.VpaidMode.INSECURE);

 // Listen and respond to ads loaded and error events.
adsLoader.addEventListener(
 google.ima.AdsManagerLoadedEvent.Type.ADS_MANAGER_LOADED,
 this.onAdsManagerLoaded,
 false);

adsLoader.addEventListener(
 google.ima.AdErrorEvent.Type.AD_ERROR,
 this.onAdError,
 false);

[Jeong-Heon Yang]

When trying to use the VPAID mode on the vast inspector of Google :

https://developers.google.com/interactive-media-ads/docs/sdks/html5/vastinspector


Disabled did not deactivate the ads, and played the ad.

Correct me if I'm wrong, as I saw on the documentation, when uising VPAID mode Disabled, we should not be able to play an ad

There seems to be a bug with Google IMA SDK not taking in account the VPAID Mode

[IMA SDK]

Hi,

Thank you for reaching out to us. It seems that the CORS settings of the ad server is preventing the IMA SDK from accessing your VPAID. Were you able to reproduce the behavior running our VPAID against your IMA implementation and your VPAID against our VSI? When I run our VPAID against the VSI with VpaidMode.INSECURE, the ad plays fine. Can you share the ad tag you were using when you encountered the behavior? Please use the reply privately to the author button if you wanna share it privately.

Regards,
Arnaud Casame
IMA SDK Team

ref:_00D1U1174p._5001UHI2KZ:ref

[Damjan Oslaj]

What should have been supplied origin if request is sent from https://potato.com? 

If I set header to res.setHeader('Access-Control-Allow-Origin', ' https://potato.com'); IMA sdk still returns the same error... as described above.

[IMA SDK]

Hi Damjan,

In order for us to deep dive with the reported behavior, could you please confirm if you were able to reproduce the behavior running our VPAID against your IMA implementation and your VPAID against our VSI? Also, can you share the ad tag (via reply privately to author option) you were using when you encountered the behavior?

Regards,

Teejay Wennie IMA SDK Team

ref:_00D1U1174p._5001UHI2KZ:ref