Symptoms

-- Applications accessed through Portal Access may fail to load or operate correctly when JavaScript code constructs XHR request URLs using document.location.origin and document.location.pathname. -- In affected scenarios, the browser console shows CORS errors referencing an about://blank/... URL. -- The application may partially load, but API calls (such as XSRF token refresh) fail, resulting in incomplete or broken functionality. -- This issue is observed after application upgrades that introduce new XSRF endpoint logic or modern JavaScript patterns.

Impact

-- Application API calls (such as XSRF token refresh) fail after the first request. -- Users experience application load failures, incomplete page rendering, or the inability to perform actions that require API calls. -- Browser console displays CORS errors referencing about://blank/... URLs. -- The application is unusable through Portal Access until a workaround or fix is applied.

Conditions

-- Portal Access is enabled and actively rewriting JavaScript in the application. -- The application builds API request URLs at runtime using document.location.origin and/or document.location.pathname. -- The affected JavaScript executes in a browser context where the frame’s location is about:blank (for example, in dynamically created iframes, popups, or after single-page application (SPA) navigation). -- The issue is most frequently observed in browsers (such as Edge and Chrome), but may also occur in other browsers.

Workaround

when REWRITE_REQUEST_DONE { if {[HTTP::path] contains ".cache.js"} { REWRITE::post_process 1 set rewrite_hist_str 1 } } when REWRITE_RESPONSE_DONE { if {[info exists rewrite_hist_str]} { unset rewrite_hist_str set rewrite_str {c.open('POST', /*F5_*/ F5_g_document /*_5F#document#*/ .location.origin+ /*F5_*/ F5_g_document /*_5F#document#*/ .location.pathname+b+'/PortalWebapp/xsrf/getNewXsrfToken',false)} set rewrite_str_len [string length $rewrite_str] set strt [string first $rewrite_str [REWRITE::payload]] if {$strt > 0} { log local0. "REPLACING PAYLOAD" REWRITE::payload replace $strt $rewrite_str_len {c.open('POST', /*F5_*/ F5_g_top.document /*_5F#document#*/ .location.origin+ /*F5_*/ F5_g_top.document /*_5F#document#*/ .location.pathname+b+'/PortalWebapp/xsrf/getNewXsrfToken',false) } } } }

Fix Information

Actual Origin is returned when JavaScript runs inside a frame with about:blank context

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips