WebView CORS problem

Vega Open Beta Bug Reports
1

Our problem what we have is CORS problem on videos. We can not play video from some address and from some address we can play them. Concrete in Welt app now. We plane to create for this app our first VegaOS version. but the big problem is that we can not play most of the content videos.

For testing: Live stream video on home is geoblocked only only to Germany.
For playing videos we are using Video.js player.

hls examples of content videos which does not work:
https://vod-stream.welt.personalstream.tv/videos/zlxwari3wsdm/rendition/8672347d1cb6afb3c656da70d6871d5a-fyzw5o4lopq3/master.m3u8

We are testing it on FireTV stick and VegaOS 0.22.

Our App.tsx:

import { WebView } from “@amazon-devices/webview”;
import * as React from “react”;
import { useRef } from “react”;
import { View, StyleSheet } from “react-native”;

export const App = () => {
const webRef = useRef(null);
return (

<WebView
// headers: {},
ref={webRef}
hasTVPreferredFocus={true}
allowSystemKeyEvents={true}
domStorageEnabled={true}
mediaPlaybackRequiresUserAction = {false}
thirdPartyCookiesEnabled={false}
allowsDefaultMediaControl={true}
mixedContentMode=“always”
source={{
// Replace with your URL.
uri: “http://pk0137-welt.tvapp-server.de/Client_V56/index_1080p.debug.Firefox.html”,
}}
javaScriptEnabled={true}
onLoadStart={(event) => {
console.log("onLoadStart url: ", event.nativeEvent.url)
}}
onLoad={(event) => {
console.log("onLoad url: ", event.nativeEvent.url)
}}
onError={(event) => {
console.log("onError url: ", event.nativeEvent.url)
}}
/>

);
};

// Styles for layout, which are necessary for proper focus behavior
const styles = StyleSheet.create({
container: { flex: 1 }
});

Error log is attached.

Welt_CORS
Welt_CORS1952×374 100 KB

I can not write here more links with examples, I will try to add them in next post.

3

Livestream which works:
https://welt.personalstream.tv:443/v1/smarttv/master.m3u8?ads.tcf=

with tcf:

https://welt.personalstream.tv/v1/smarttv/master.m3u8?ads.tcf=CQfdcEAQfdcEAFZABCENCRFgAP_AAEAAAATIIzQFgAKgAggBOAFAALQAZABGACYAE4AMQAgABGADKAIsAR0AkoBdQF5gL2AYoAywBrgEZgLzgDAAggBOAFAAMgAmAElAXmAQEgBAAVAGUFAAwAnACgdALAAqACAAGQATAAxADKAIsAR0AkoC8wGWEIAIAYiUAMAJgAYgF5kgAIDLCkAsACoAIAAZABMADEAMoAiwBHQCSgLzAZYUAAgF1AAA.YAAAAAAAAAAA

4

mp4 file which works:

5

hls examples o content videos which does not work:

https://vod-stream.welt.personalstream.tv/videos/zlxwari3wsdm/rendition/8672347d1cb6afb3c656da70d6871d5a-fyzw5o4lopq3/master.m3u8

https://vod-stream.welt.personalstream.tv/videos/33on74wdc7gw/rendition/6aefca71f14062227caf718c42786da1-l84btst9q7llpcr1-pgm-10-00-onl-off-und-studiotalk-kather-1129/master.m3u8

6

My manifest.toml:
schema-version = 1

[package]
title = “Basic UI React Native Application for project vegawebapp”
version = “0.1.0”
id = “com.mekmedia.vegawebapp”

[components]
[[components.interactive]]
id = “com.mekmedia.vegawebapp.main”
runtime-module = “/com.amazon.kepler.keplerscript.runtime.loader_2@IKeplerScript_2_0”
launch-type = “singleton”
categories = [“com.amazon.category.main”]

[wants]

Web renderer service for rendering web content

[[wants.service]]
id = “com.amazon.webview.renderer_service”

If Web App needs keyboard support

[[wants.service]]
id = “com.amazon.inputmethod.service”

If Web App needs video playback

[[wants.service]]
id = “com.amazon.media.server”

Required for emitting metrics from video playback

[[wants.service]]
id = “com.amazon.mediametrics.service”

Required for video playback on stable APIs

[[wants.service]]
id = “com.amazon.mediabuffer.service”
[[wants.service]]
id = “com.amazon.mediatransform.service”

If Web App needs audio playback

[[wants.service]]
id = “com.amazon.audio.stream”

Required for audio management features to work in WebView, features like audio focus, volume control

[[wants.service]]
id = “com.amazon.audio.control”

To enable accessibility support for your app, we recommend you add the UCC service with the Service Registrar

[[wants.service]]
id = “com.amazon.kepler.ucc.publisher”

Uncomment below section to enable encrypted media playback (DRM content)

[[wants.service]]

id = “com.amazon.drm.key”

[[wants.service]]

id = “com.amazon.drm.crypto”

[[needs.privilege]]

id = “com.amazon.privilege.security.file-sharing”

Enable Group-IPC to access media services

[[wants.service]]
id = “com.amazon.gipc.uuid."
[offers]
[[offers.service]]
id = "com.amazon.gipc.uuid.”

You may add other services as needed

7

Hi @MEKmedia_Developer,

Welcome to Amazon Developer Community!!

Thank you for the detailed bug report on the WebView CORS issue with video playback on VegaOS.

Our team is investigating this issue and will provide an update as soon as we have more information.

In the meantime, could you please share the full error logs? This will help us investigate the issue more effectively.

Thanks for helping us improve the Vega platform.

Warm regards,
Aishwarya

8

Hi Aishwarya,

thanks for fast reply. I can send you everything what you need , but what do you imagine like full error logs please?

Best regards
Josef

9

Hi @MEKmedia_Developer,

To help us investigate the CORS issue further, could you please share:

  1. Minimal reproducible code — A simplified version of your app that demonstrates the issue (just the essential code needed to reproduce the problem)

  2. Full error logs — Complete console output showing the CORS errors, including any network request failures or WebView errors

You can capture logs using the instructions here:

This will help our team identify the root cause more quickly.

Thanks for your patience!

Best regards,
Aishwarya

10

Hi @amen ,

I prepared reduced app version which only get data and try to play video. App is on this link:

How I see the error:
Stream is from different domain then the app → in stream responce header have to be property "Access-Control-Allow-Origin: * ". It is missing and app runs in WebView → CORS Error.

Stream runs on customer server and we can not change it.
In normal WebView in React nativ exist possibility to disable it by setting “originWhitelist={[‘*’]}”, but this does not exist in KeplerWebView.
Is there any other possibility to set trusted domains?

Other solution is to use native player and do not play videos in WebView, because native player does not take care about CORS.

I checked log files by documentation, but htere was lot of files and nothing about CORS or Network error. I copied here header from one file, to help you understand which device i have.

BeginIndex: 461036827
BootId: 2ce5a8e8395b408988996e779ba71566
BuildVariant: user
DeviceGroup: Public
EndIndex: 640589943
FileIndex: 3272
LastModified: 1773900884
OsBuildNumber: 1401010009820
Source: acs_main.log.gz
SystemVersion: 4.0.227617.0(3072cab629675a74)/98N:user/release-keys
UpTimems: 642000

Best regards
Josef

12

Hi @amen,

do you have something new for us? Thanks a lot

13

Hi @MEKmedia_Developer ,

Thank you for your patience.

We’ve tested the stream URL on our end and were unable to reproduce the CORS issue - video playback worked as expected in our environment.

Could you let us know:

  1. Which device and OS build are you currently testing on?

  2. Are you still seeing the issue with the latest build?

This will help us narrow down whether this is device/build-specific.

Thanks,
Aishwarya

14

Hi @Aishwarya,
what your environment means? For test you can run this link in WebView: WELT - 2 Step Video Chain Test We have SDK 0.22.6759 and OS 1.1 (14010110010220). And we have still CORS Issue.

15

Hi @MEKmedia_Developer,

Thank you for your patience.

Could you please let us know if you are still blocked on this issue? If yes, which videos are still not working?

Thanks,
Aishwarya

16

Hi @MEKmedia_Developer,

Just following up - we’ve confirmed that native HLS playback in WebView is fixed in the latest build. Both your VOD URLs now work. Could you please update and let us know if this resolves the issue on your end?

Thanks,
Aishwarya

17

Hi, videos plays, but only of we remove CORS from server. If on server is still CORS it does not play.

18

Hi @MEKmedia_Developer,

Thank you for the update. To clarify - could you confirm which OS build/release you are currently testing on?

Also, when you say “remove CORS from server” - do you mean the server stops sending Access-Control-Allow-Origin headers, or that you’re disabling CORS enforcement entirely? Could you share the exact response headers from the stream server when CORS is enabled?

This will help us determine if this is a remaining WebView CORS handling issue separate from the original HLS playback fix.

Thanks,
Aishwarya