9

When navigating Stack Exchange, I get this error in my browser's console

The resource from “https://cdn.cookielaw.org/scripttemplates/otSDKStub.js” was blocked due to MIME type mismatch (X-Content-Type-Options: nosniff).

I'm using Seamonkey. My browser is also continuously asking about my cookie settings, but only on Stack Exchange. Is this a problem with the site or with my browser?

Seamonkey says about this error:

Note: X-Content-Type-Options only apply request-blocking due to nosniff for request destinations of "script" and "style". However, it also enables Cross-Origin Read Blocking (CORB) protection for HTML, TXT, JSON and XML files (excluding SVG image/svg+xml).

Improve this question
16
  • 1
    There is this report on the meta of AskUbuntu that seems similar: meta.askubuntu.com/questions/19480/… but that is for a firefox browser. Not sure if SeaMonkey is spin-off.
    – rene Mod
    Commented Feb 14, 2021 at 10:00
  • 1
    Nowadays a large part of the code is based on Firefox's.
    – Gerard H. Pille
    Commented Feb 14, 2021 at 10:03
  • 1
    Adding a link to the Cookie consent announcement for reference.
    – rene Mod
    Commented Feb 14, 2021 at 10:04
  • 1
    Does StackExchange expect people to whitelist cookielaw.org? I didn't find it on the cookie consent announcement, neither that a third party would be used.
    – Gerard H. Pille
    Commented Feb 14, 2021 at 10:08
  • Not sure about FF itself (because it's overruled by another extension and a DNS sinkhole), but both uBlock and pihole blocks cookielaw. Not sure what the privacy implications of this are
    – Zoe - Save the data dump
    Commented Feb 14, 2021 at 10:10
  • 2
    It is strange that I don't seem to have a cookie from them nor do I see their domain so I'm also wondering for what purpose that domain gets loaded and what its role is in giving consent. This needs an answer from SE devs.
    – rene Mod
    Commented Feb 14, 2021 at 10:25
  • 1
    I've got uBlock Origin, but cookielaw doesn't appear in its logs. That and the console message indicate the block is from Seamonkey - or Firefox - itself.
    – Gerard H. Pille
    Commented Feb 14, 2021 at 10:25
  • No repro, might be something on your side. (malware, or your browser doing something on its own)
    – Shadow Wizard
    Commented Feb 14, 2021 at 12:59
  • @ShadowWizardisVaccinating What is the meaning of "no repro" ?
    – Gerard H. Pille
    Commented Feb 14, 2021 at 14:37
  • @Gerard it means "I am not able to reproduce the problem by myself, on my side".
    – Shadow Wizard
    Commented Feb 14, 2021 at 14:39
  • @ShadowWizardisVaccinating ok, I'll try to locate the origin of that call. I've never once faced malware on one of my systems, I blame it on Linux and keeping away of asocial media.
    – Gerard H. Pille
    Commented Feb 14, 2021 at 15:03
  • @GerardH.Pille well might also be something else, can't really know, but since it's not happening to everyone, don't think it's on SE side.
    – Shadow Wizard
    Commented Feb 14, 2021 at 17:40
  • @ShadowWizardisVaccinating The request to cookielaw.org is sent when you hit the button "accept all cookies". This wouldn't be SE's doing?
    – Gerard H. Pille
    Commented Feb 14, 2021 at 19:45
  • While I don't experience this issue in stock Firefox profiles without extensions, there are a variety of extensions which block requests to load JavaScript from untrusted domains. One such extension which I use, NoScript, will, by default, block JavaScript from any domain unless the settings for the source domain are manually changed. At least with NoScript, it's necessary to first click one of the buttons on the cookie popup. When you do, the request will be made for code from cookielaw, which then puts the domain in the list for which you can choose to allow loading JavaScript, or not.
    – Makyen
    Commented Feb 14, 2021 at 20:08
  • @GerardH.Pille you said only "When navigating Stack Exchange" you never mentioned hitting any button. That's very crucial step. Anyway, where you see "accept all cookies" button?
    – Shadow Wizard
    Commented Feb 15, 2021 at 7:41

1 Answer 1

Reset to default
4

The problem is caused by the fact that I'm using Tor. The request for "https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" is answered by a 403 with a page "Error 1020 access denied". Strangely, a request for "https://cdn.cookielaw.org/cdn-cgi/styles/main.css" is answered without problem.

The 403 comes with a content-type text/html and a x-content-type-options nosniff, which causes the console error above.

Improve this answer
3
  • I am suffering from this problem as well. Given that it's just loading a static resource, it's bizarre that it would need to block access from Tor.
    – forest distrusts StackExchange
    Commented Feb 21, 2021 at 0:10
  • The reason usually is that they'd like to know who's reading what.
    – Gerard H. Pille
    Commented Feb 21, 2021 at 9:48
  • I worked around this by "allowlisting" a non-tor direct connection, to cookielaw.org only, in network.proxy.no_proxies_on in about:config (found via superuser.com/a/1094945).
    – Joel Reid
    Commented May 3, 2022 at 11:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .