'Error: could not get tokens' with browserSession: true

[fuddl]

I am working on a browser extension and I'm trying to swich to wikibase-edit instead of making edits directly. Since the extension uses the browser session to make edits, I'm using the newly added browserSession: true credential setting.

• wikibase-edit version: 7.0.2
• Environment: Firefox 123.0.1 (64-bit)

When I try to make an edit. I get the following error:

Error: could not get tokens

The server does not respond with an error, but the response does not contain tokens but the follwoing warning:

Tokens may not be obtained when the same-origin policy is not applied.

❌ wikibase-edit tries to get the token from

https://playground.wikibase.cloud/w/api.php?action=query&meta=tokens&type=csrf&format=json&origin=*

✅ This is how I got the token before switching to wikibase-edit:

https://playground.wikibase.cloud/w/api.php?action=query&meta=tokens&format=json

When I removed the origin=* parameter in wikibase-edit, it worked just fine.

Edit

The issue might be here.

In the context of a webextension, globalThis.location is a local script. In my case it is moz-extension://0f0a018a-2719-427a-9df6-84e39a92a619/background/index.html. To technically the request is crossorigin.

[maxlath]

I removed the origin=* parameter in v7.0.3, can you give it a try?

[fuddl]

I'm getting a different error now. But I think it's unrelated to this issue. Thank you!

[fuddl]

Sorry, I'm not sure, what is going on. I prepared a simple webextension for testing.

Clicking the button will yield the following errors in the Multiprocess browser console:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at ‘https://www.wikidata.org/w/api.php?action=wbgetentities&ids=P1106&format=json&props=info&origin=*’. (Reason: Credential is not supported if the CORS header ‘Access-Control-Allow-Origin’ is ‘*’).

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://www.wikidata.org/w/api.php?action=wbgetentities&ids=P1106&format=json&props=info&origin=*. (Reason: CORS request did not succeed). Status code: (null).

Uncaught (in promise) TypeError: NetworkError when attempting to fetch resource.

The extension uses 7.0.3

​