Steps to replicate the issue (include links if applicable):
- Go to https://auth.wikimedia.org/jawiki/wiki/特別:アカウント作成
- Click "アカウントを作成する" (Create account button)
- Open browser developer console (F12)
What happens?:
CORS error appears in console and hCaptcha does not load:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://assets-hcaptcha.wikimedia.org/captcha/1/73f27c192b38c05ce2ebce596a0e28f88a2a56bf/secure-api.js?endpoint=https%3A%2F%2Fhcaptcha.wikimedia.org&assethost=https%3A%2F%2Fassets-hcaptcha.wikimedia.org&imghost=https%3A%2F%2Fimgs-hcaptcha.wikimedia.org&reportapi=https%3A%2F%2Freport-hcaptcha.wikimedia.org&render=explicit&onload=onHCaptchaSDKLoaded (Reason: CORS header 'Access-Control-Allow-Origin' missing). Status code: 200.
The same error occurs on https://auth.wikimedia.org/enwiki/wiki/Special:CreateAccount
What should have happened instead?:
hCaptcha should load normally, allowing account creation.
Workaround found:
hCaptcha loads correctly when using https://auth.wikimedia.org/mediawikiwiki/w/index.php?title=Special:CreateAccount instead.
Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):
Other information (browser name/version, screenshots, etc.):
- Disabling tracking protection did not help
- No VPN or proxy in use
- Reproduced on:
- Firefox (latest)
- Microsoft Edge (latest)
- Also occurs in private browsing / incognito mode
- All extensions disabled, tracking prevention turned off
- Works perfectly on: https://auth.wikimedia.org/mediawikiwiki/w/index.php?title=Special:CreateAccount
This may indicate a wiki-specific configuration difference...
Related task: T388902 (hCaptcha proxy + CSP), T419265
https://auth.wikimedia.org/enwiki/wiki/Special:CreateAccount
https://auth.wikimedia.org/mediawikiwiki/w/index.php?title=Special:CreateAccount
There is no loading of https://assets-hcaptcha.wikimedia.org/* from https://auth.wikimedia.org/mediawikiwiki/w/index.php?title=Special:CreateAccount