React-player: Error parsing header X-XSS-Protection: 1; When playing youtube videos

[davidwwu]

This issue popped up sometime between last week and this week which causes issues such as setting the playing=true state does not work and many more. The demo site also gives this error. Here's the Full text

Error parsing header X-XSS-Protection: 1; mode=block; 
report=https://www.google.com/appserve/security-bugs/log/youtube: insecure reporting URL for 
secure page at character position 22. The default protections will be applied.

[davidwwu]

after a little more investigation, turns out this is a chrome-specific error. I think the error will go away in the future since this is not the first time that the error pops up.

[dribgib]

This is showing for me on every site that I embed YouTube on

[eapostol]

+1

[frozenscar]

it works fine in incognito window tho, i have the same error, tell me how you fixed yours? maybe?

[dribgib]

I think it has something to do with prefetching?

[LukeDouglas2]

Yea, I'm getting this now. My server was upgraded to EasyApache 4 and I've been having quite a few issues but this one surprised me as I have other blogs that are working on other websites. IOn the Network tab, it shows the following TWICE with the 2nd one being the last thing called before getting the dreaded 404 blank page.

data:image/svg+xml;charset=utf-8;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIGhlaWdodD0iMzBweCIgd2lkdGg9IjMwcHgiIHZpZXdCb3g9Ii0xIC0xIDMxIDMxIj48Zz48cGF0aCBkPSJNMjkuNDQ5LDE0LjY2MiBDMjkuNDQ5LDIyLjcyMiAyMi44NjgsMjkuMjU2IDE0Ljc1LDI5LjI1NiBDNi42MzIsMjkuMjU2IDAuMDUxLDIyLjcyMiAwLjA1MSwxNC42NjIgQzAuMDUxLDYuNjAxIDYuNjMyLDAuMDY3IDE0Ljc1LDAuMDY3IEMyMi44NjgsMC4wNjcgMjkuNDQ5LDYuNjAxIDI5LjQ0OSwxNC42NjIiIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIxIj48L3BhdGg+PHBhdGggZD0iTTE0LjczMywxLjY4NiBDNy41MTYsMS42ODYgMS42NjUsNy40OTUgMS42NjUsMTQuNjYyIEMxLjY2NSwyMC4xNTkgNS4xMDksMjQuODU0IDkuOTcsMjYuNzQ0IEM5Ljg1NiwyNS43MTggOS43NTMsMjQuMTQzIDEwLjAxNiwyMy4wMjIgQzEwLjI1MywyMi4wMSAxMS41NDgsMTYuNTcyIDExLjU0OCwxNi41NzIgQzExLjU0OCwxNi41NzIgMTEuMTU3LDE1Ljc5NSAxMS4xNTcsMTQuNjQ2IEMxMS4xNTcsMTIuODQyIDEyLjIxMSwxMS40OTUgMTMuNTIyLDExLjQ5NSBDMTQuNjM3LDExLjQ5NSAxNS4xNzUsMTIuMzI2IDE1LjE3NSwxMy4zMjMgQzE1LjE3NSwxNC40MzYgMTQuNDYyLDE2LjEgMTQuMDkzLDE3LjY0MyBDMTMuNzg1LDE4LjkzNSAxNC43NDUsMTkuOTg4IDE2LjAyOCwxOS45ODggQzE4LjM1MSwxOS45ODggMjAuMTM2LDE3LjU1NiAyMC4xMzYsMTQuMDQ2IEMyMC4xMzYsMTAuOTM5IDE3Ljg4OCw4Ljc2NyAxNC42NzgsOC43NjcgQzEwLjk1OSw4Ljc2NyA4Ljc3NywxMS41MzYgOC43NzcsMTQuMzk4IEM4Ljc3NywxNS41MTMgOS4yMSwxNi43MDkgOS43NDksMTcuMzU5IEM5Ljg1NiwxNy40ODggOS44NzIsMTcuNiA5Ljg0LDE3LjczMSBDOS43NDEsMTguMTQxIDkuNTIsMTkuMDIzIDkuNDc3LDE5LjIwMyBDOS40MiwxOS40NCA5LjI4OCwxOS40OTEgOS4wNCwxOS4zNzYgQzcuNDA4LDE4LjYyMiA2LjM4NywxNi4yNTIgNi4zODcsMTQuMzQ5IEM2LjM4NywxMC4yNTYgOS4zODMsNi40OTcgMTUuMDIyLDYuNDk3IEMxOS41NTUsNi40OTcgMjMuMDc4LDkuNzA1IDIzLjA3OCwxMy45OTEgQzIzLjA3OCwxOC40NjMgMjAuMjM5LDIyLjA2MiAxNi4yOTcsMjIuMDYyIEMxNC45NzMsMjIuMDYyIDEzLjcyOCwyMS4zNzkgMTMuMzAyLDIwLjU3MiBDMTMuMzAyLDIwLjU3MiAxMi42NDcsMjMuMDUgMTIuNDg4LDIzLjY1NyBDMTIuMTkzLDI0Ljc4NCAxMS4zOTYsMjYuMTk2IDEwLjg2MywyNy4wNTggQzEyLjA4NiwyNy40MzQgMTMuMzg2LDI3LjYzNyAxNC43MzMsMjcuNjM3IEMyMS45NSwyNy42MzcgMjcuODAxLDIxLjgyOCAyNy44MDEsMTQuNjYyIEMyNy44MDEsNy40OTUgMjEuOTUsMS42ODYgMTQuNzMzLDEuNjg2IiBmaWxsPSIjYmQwODFjIj48L3BhdGg+PC9nPjwvc3ZnPg==

[phpony]

It's a known bug in current Google Chrome and Chromium: https://bugs.chromium.org/p/chromium/issues/detail?id=807304

In current version of their browser Chrome developers had restricted the X-XSS-Protection's report field URL to the same domain origin for some security reasons. So, when you embed video with some embed code, at it downloads from another server where the header report=https://www.google.com/ is set, and while your page is not hosted at google.com domain - the error message occurs.

Just wait till they'll sort this out.

[estlacksensory]

Happens in incognito as well.

[Unlighten]

Is there a fix for this? Or do we just wait it out, because so far... My video isn't even showing.

[cookpete]

@Unlighten this shouldn't prevent your video from showing, unless something else is going on. What URL are you trying to play?

[pdeka]

Has anyone found a solution for this issue?

[h3ct0rjs]

Hi everybody,
I'm having the same problem with a couple of php apps. Is there any way to bypass this error or supress the msg.

Best Regards,
Hector F.

[Sharlyn97]

Hello! I have the same problem :(

[phpony]

@Sharlyn97 @h3ct0rjs @pdeka just to be clear - the error message mentioned here appears everywhere. Like, just open every Youtube video and check the console - here it is. If Google - the owner both of Youtube and Chrome - can't fix this, how anyone else can help?

By the way, this error message is only informing about the current state of appliance of X-XSS-Protection politics. Those politics normally has nothing to do with media content or script functionality on page, they should not affect play-ability of any video or audio. So if something is not working and video is not showing - dig further, check for any other errors, open another issue with more details and just ignore this concrete warning message. It's colored red and looks dangerous, but it's informational, going from browser's internals and is not interfering with scripts on page in any manner.

[Sharlyn97]

thanks

2018-02-24 15:53 GMT-06:00 Volkov Maksim [e-mail]:

@Sharlyn97 https://github.com/sharlyn97 @h3ct0rjs
https://github.com/h3ct0rjs @pdeka https://github.com/pdeka just to
be clear - the error message mentioned here appears everywhere. Like, just
open every Youtube video and check the console - here it is. If Google -
the owner both of Youtube and Chrome - can't fix this, how anyone else can
help?

By the way, this error message is only informing about the current state
of appliance of X-XSS-Protection politics. Those politics normally has
nothing to do with media content or script functionality on page, they
should not affect play-ability of any video or audio. So if something is
not working and video is not showing - dig further, check for any other
errors, open another ticked with more details and just ignore this concrete
message. It's colored red and looks dangerous, but it's informational,
going from browser's internals and is not interfering with scripts on page
in any manner.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/CookPete/react-player/issues/288#issuecomment-368263216,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AOmtDKRiyBdbcX2kdkcUrAD2OwuOaByXks5tYITNgaJpZM4QzoQs
.

[h3ct0rjs]

@google
@aarongable

[Unlighten]

@CookPete Found the issue for video not showing. I guess I like to spell responsive as "reponsive." Feelsbadman. Anyways... The video is showing, however I cannot play any videos.

[Daviers01]

This is my problem too. I don't have any problem playing the youtube video but the console error is not pleasing to the eye lol. I thought I'm just having some CORS errors.
Anyway, does anyone know how remove the error from the console?

[DuverCode]

Hola, yo también presento ese mis mensaje de error, mientras manipulo la api de youtube o incrusto un video del canal, pero efectivamente este mensaje no afecta la funcionalidad para poder visualizar el video correctamente.
Actualmente puedo ver los videos sin problema y utilizar sus funcionalidades.

[PabloMonfort]

i can play videos using tools for developers then refresh with responsive or use a mobile choice screen then you can play the videos and watch them on fullscreen ... but the errors still appears and i had to do this each time i want to see a video on youtube. hope this help to someone bye.

[GeoffreyPlitt]

happening to me right now

[Adamkzh]

same problem, btw, there is no error on firefox or safari.

[cookpete]

I don't think any further conversation is useful so I'm going to lock this. As @phpony pointed out, this is an issue with Chrome and not ReactPlayer.

The bug is being tracked here – there is a fix in Chrome 66.0.3336.0 which is in Canary and so will be released in a stable build soon. The solution is just to be patient and wait for the next Chrome update.