Closed Icon sprite cache breaks when accessing XenForo from another domain or protocol

Painbaker

Painbaker

Well-known member
Licensed customer
Affected version
2.3.13
XenForo generates SVG sprite URLs through localDataUrl

If it returns an absolute URL, accessing the site from another domain or protocol makes the sprite cross-origin

Browsers then block SVG <use> references causing cached icons to disappear
 
This is basically behaving as expected. localDataUrl being absolute is not a supported configuration.
 
The issue occurs when the same installation is accessible through multiple origins without configuring absolute localDataUrl
For example these are different origins:
http://site.example.com
https://site.example.com
https://demo.example.com

If the page is loaded from one origin while the cached SVG sprite URL points to another
the browser blocks the <use> reference with a CORS mixed-content or unsafe cross-origin SVG error
 
Last edited:
Can you be a bit more specific about the configuration?

To be clear, if you set an absolute URL for this, it won't work and it's not expected to.

If it's a relative URL please tell us specifically what you set.

There's ambiguity between a couple of your messages.

If no absolute URL was set, and the relative URL causes the CORS issues, this is expected to work and, if it doesn't, that would likely be down to your own web server configuration and not XenForo.
 
Clarification: this affects CSS icons, not SVG <use> sprites and also requires different base paths. Not just different domains

The same installation is accessible at https://example.com/ and https://new-example.com/community/.

XF generates the icon URL using the current request base path. If CSS is first generated through http://new-example.com/community/css.php, it includes /community/styles/fa/... That CSS is then cached and reused on the other domain because the cache key does not include the base path.

Even with canonical URLs enabled, CSS generated through the first URL can be reused on the second with /community/styles/fa/... URLs that return 404.

PS: No absolute localDataUrl or CDN or custom callback is configured. The installation uses the XenForo defaults.
 
I suggest filing a new report with the correct information. This whole thread is too confusing at this point to be useful, unfortunately. We’ll retriage it from scratch and try to repro.

Specific replication steps are useful in bug reports.
 
Last edited:
Back
Top Bottom