ObjectFS redirects eligible Moodle file requests to presigned URLs when presigned URL redirects are enabled. Some Moodle components, however, load files using XHR/fetch from within an iframe or other contexts where redirecting to a presigned URL can cause CORS preflight failures.
Introduce an admin setting that allows administrators to configure which Moodle component/filearea pairs should bypass presigned URL redirects.
Background:
SCORM packages that use XHR (XMLHttpRequest) to load content files (audio, CSS, JS, JSON, images) fail with a CORS error when objectfs presigned URL redirects are enabled.
Steps to reproduce:
- Configure objectfs with S3/CloudFront and enable presigned URL redirects
- Upload a SCORM package created with Adobe Captivate (that uses XHR-based resource loading)
- Launch the SCORM activity
- Observe that media files (e.g., MP3 audio) fail to load
Expected behaviour:
All SCORM content files load successfully within the SCORM player.
Actual behaviour:
The browser console shows:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource ...... (Reason: CORS preflight response did not succeed). Status code: 403
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at ...... (Reason: CORS request did not succeed). Status code: (null)
ObjectFS redirects eligible Moodle file requests to presigned URLs when presigned URL redirects are enabled. Some Moodle components, however, load files using XHR/fetch from within an iframe or other contexts where redirecting to a presigned URL can cause CORS preflight failures.
Introduce an admin setting that allows administrators to configure which Moodle component/filearea pairs should bypass presigned URL redirects.
Background:
SCORM packages that use XHR (XMLHttpRequest) to load content files (audio, CSS, JS, JSON, images) fail with a CORS error when objectfs presigned URL redirects are enabled.
Steps to reproduce:
Expected behaviour:
All SCORM content files load successfully within the SCORM player.
Actual behaviour:
The browser console shows: