Refused to execute script from .. when call is proxied through //tpc.googlesyndication.com/pagead/js/loader12.html

[Nayana Hettiarachchi]

I am using HTML5 IMA sdk, from time to time i get an error saying that can't execute the flash script downloaded. and i noticed a reproducable pattern when this happens. it always 100% of the time happens when the call gets redirected through 

tpc.googlesyndication.com/pagead/js/loader12.html

full URL https://tpc.googlesyndication.com/pagead/js/loader12.html?https://imasdk.googleapis.com/flash/sdkloader/vpaid1adsdk.swf%3fadTagUrl=https%253A%252F%252Fgoogleads.g.doubleclick.net%252Fpagead%252Fads%253Fclient%253Dca-video-pub-8637246282765423%2526slotname%253D3476964357%2526ad_type%253Dflash%2526description_url%253Dhttp%25253A%25252F%25252Fbrokenbulbstudios.com%2526videoad_start_delay%253D0&type=all

when the code is working it just gets redirected through http://imasdk.googleapis.com/js/core/bridge3.144.0_en.html

is this a bug on google end? 

you can visit http://www.appcdn.net/sdk/v2.1/index.html to see my implementation. 

Thanks

[Nayana Hettiarachchi]

when i checked the same URL from Safari i see the following error 

 

Linear assets were found in the VAST ad response, but none of them matched the video player's capabilities

I read somewhere this means the IMA HTML5 SDK is not able to play this creative. However  how does it play the same flash creative when the redirect path is different?

[Vu Chau (IMA SDK Team)]

Hi Nayana, 

The issue might be related to Cross Origin Resource Sharing (CORS).  https://tpc.googlesyndication.com can sometimes be found in the header of the ad request.  If your ad server returns a response with the Access-Control-Allow-Origin header that is not properly set (often it is set to a wildcard *), that can cause problems.  Make sure the Allow Origin header in the response is set to https://tpc.googlesyndication.com (although it should normally be https://imasdk.googleapis.com).

If you are not administering your ad server, I'd talk to the respective admin to get that rectified.

Let us know if you see an improvement,

Vu Chau

IMA SDK Team

[Marta Perego]

Hi Vu,

Our Preroll request has the "access-control-allow-origin" set to "http://imasdk.googleapis.com" instead of "https://imasdk.googleapis.com".

Could you tell me how we can change it, please?

Is it also possible to add "https://tpc.googlesyndication.com" to "access-control-allow-origin"?

Thanks,

Marta

[Vu Chau (IMA SDK Team)]

Hi Marta,

Advising on how to modify the headers of the request and response is out of scope for us, but I have found a few resources that might be helpful:

1. Origin is not allowed by Access-Control-Allow-Origin
2. Cross-Origin-Resource-Sharing (CORS) for VAST

Most (if not all) of the changes would take place on your network / with your ad server, which would be beyond IMA.

Let me know if you have any questions,

Vu Chau

IMA SDK Team