Fixing CORB When Loading Assets from a Self-Hosted Gitea

After setting up my own Gitea instance, I mirrored the website’s assets to a repository to speed up the site and make full use of Gitea.

When the site requested assets from the repository, the browser blocked them with CORB (Cross-Origin-Read-Blocking).

The fix has two parts: allow cross-origin requests with an empty Origin header, and set MIME types correctly.

Configure CORS correctly

Add the following to Gitea’s config file app.ini:

text

[cors]
ENABLED = true
ALLOW_DOMAIN = *

And write the nginx reverse-proxy config like this to allow cross-origin requests with an empty Origin header:

text

server {
    ...# configure everything outside location yourself; what matters is inside location
    location / {
        client_max_body_size 512M;
        proxy_pass http://localhost:3000; # assuming Gitea runs on localhost:3000
        add_header 'Access-Control-Allow-Origin' '*';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization';
        add_header 'Access-Control-Allow-Credentials' 'true';
        if ($request_method = 'OPTIONS') {
            add_header 'Access-Control-Allow-Origin' '*';
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
            add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization';
            add_header 'Access-Control-Allow-Credentials' 'true';
            add_header 'Access-Control-Max-Age' 1728000;
            add_header 'Content-Type' 'text/plain charset=UTF-8';
            add_header 'Content-Length' 0;
            return 204;
        }
    }
}

Set MIME types correctly

Browsers block resources whose MIME type doesn’t match. According to Gitea’s official config documentation, setting the MIME types correctly is all it takes to fix CORB.

Add the following to app.ini:

text

[repository.mimetype_mapping]
.js = text/javascript
.css = text/css
.woff = font/woff
.woff2 = font/woff2
.ttf = font/ttf

Here .xxx is the extension of the requested resource and xxxx/xxxx is its MIME type. You can look up the MIME type for an extension here.