# If your Twitch extension Local Test suddenly started throwing a CORS error… **URL:** \ **Category:** Extensions\ **Created:** [November 13, 2025, 4:20am UTC](https://discuss.dev.twitch.com/t/if-your-twitch-extension-local-test-suddenly-started-throwing-a-cors-error/64438 "2025-11-13T04:20:14Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ohadialex](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/ohadialex/32/25014_2.png) [@ohadialex](https://discuss.dev.twitch.com/u/ohadialex)\ **Post date:** [November 13, 2025, 4:20am UTC](https://discuss.dev.twitch.com/t/if-your-twitch-extension-local-test-suddenly-started-throwing-a-cors-error/64438/1 "2025-11-13T04:20:14Z")
**Spent 5+ hours and finally figured this out** …. when my local testing stopped working hope this helps!\*\* Symptom\*\* - You’re using **Local Test** for a Twitch extension. - Your Testing Base URI is something like `https://localhost:8080/`. - The Twitch dashboard iframe points at: - DevTools → **Network** shows: - Opening `https://localhost:8080/config.html` directly in a tab works fine. **What’s actually happening** Your CORS and HTTPS can be totally correct and **Chrome will still block it**. Recent Chrome versions added a **Local Network Access check**. A public HTTPS site (like `https://dashboard.twitch.tv`) isn’t allowed to embed / talk to `localhost` or your LAN unless the browser grants special local network access permissions. Twitch’s dashboard iframe doesn’t request that permission, so Chrome refuses the request and mislabels it as a “CORS error” with `LocalNetworkAccessPermissionDenied`. Your backend never even gets a chance to respond. ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [November 13, 2025, 11:37am UTC](https://discuss.dev.twitch.com/t/if-your-twitch-extension-local-test-suddenly-started-throwing-a-cors-error/64438/2 "2025-11-13T11:37:14Z")
And thats why my localtest is on a real SSL domain instead of localhost as it’s a more accurate represenatiation of hosted/release ---
**Author:** ![kardinalzyn](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/kardinalzyn/32/31759_2.png) [@kardinalzyn](https://discuss.dev.twitch.com/u/kardinalzyn)\ **Post date:** [April 1, 2026, 5:38am UTC](https://discuss.dev.twitch.com/t/if-your-twitch-extension-local-test-suddenly-started-throwing-a-cors-error/64438/3 "2026-04-01T05:38:45Z")
Hi Barry, Totally new extension dev here and I am having a lot of issues related to chromium localhost permission stuff. Specifically, Cross-Origin Request errors (using the same localhost, just my API endpoint is on a port) and the dreaded “unsafe attempt to load URL - domains protocols and ports must match” error. Do you have/know of any resources that could help me test using a (as you described) “a real SSL domain” so I can get out of this web permissions hellscape? LOL I ultimately plan to use something like ngrok or cloudflare tunnel with a host domain name to serve content only for my twitch page (for starters). Can you use such URLs/tunneling services for the “local hosting” phase? Thanks in advance! I’m excited to see what I can create with these awesome tools! 😁 ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [April 1, 2026, 10:21am UTC](https://discuss.dev.twitch.com/t/if-your-twitch-extension-local-test-suddenly-started-throwing-a-cors-error/64438/4 "2026-04-01T10:21:45Z")
> [@kardinalzyn](#): > > Do you have/know of any resources that could help me test using a (as you described) “a real SSL domain” so I can get out of this web permissions hellscape? LOL > > I ultimately plan to use something like ngrok or cloudflare tunnel with a host domain name to serve content only for my twitch page (for starters). Can you use such URLs/tunneling services for the “local hosting” phase? This is the answer to your question for development. I use a real domain on my extension EBS with a reverse SSH tunnel so I don’t rely on other tools I use my own. (given the tools like ngrok do _pretty much_ exactly that but you have to use thier service(s) I just use my own server where the production EBS is with additional sub domains for test front end and test backend) ---
**Author:** ![jompoh](https://avatars.discourse-cdn.com/v4/letter/j/c6cbf5/32.png) [@jompoh](https://discuss.dev.twitch.com/u/jompoh)\ **Post date:** [May 12, 2026, 8:28pm UTC](https://discuss.dev.twitch.com/t/if-your-twitch-extension-local-test-suddenly-started-throwing-a-cors-error/64438/5 "2026-05-12T20:28:56Z")
Try the flags disable-web-security in a temporary user-data-dir [https://stackoverflow.com/a/3177718](https://stackoverflow.com/a/3177718) Firefox-based browers also work, even with `http://localhost:8080`. ---
**Author:** ![jompoh](https://avatars.discourse-cdn.com/v4/letter/j/c6cbf5/32.png) [@jompoh](https://discuss.dev.twitch.com/u/jompoh)\ **Post date:** [August 3, 2026, 4:09pm UTC](https://discuss.dev.twitch.com/t/if-your-twitch-extension-local-test-suddenly-started-throwing-a-cors-error/64438/6 "2026-08-03T16:09:40Z")
Firefox is on progressive rollout with the feature, iframes are blocked with auto\_deny now. > [@ohadialex](#): > > Twitch’s dashboard iframe doesn’t request that permission, so Chrome refuses the request and mislabels it as a “CORS error” with `LocalNetworkAccessPermissionDenied`. Some online HTML viewers are able to prompt for local access when using iframes. This could help [https://docs.google.com/document/d/1QQkqehw8umtAgz5z0um7THx-aoU251p705FbIQjDuGs/edit](https://docs.google.com/document/d/1QQkqehw8umtAgz5z0um7THx-aoU251p705FbIQjDuGs/edit) For now, set chrome://flags/#local-network-access-check to `disabled`. In Firefox set `network.lna.blocking` in about:config to false, or use `network.lna.skip-domains`. This was the default a year ago. ---
**Author:** ![TheUKDude](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/theukdude/32/28386_2.png) [@TheUKDude](https://discuss.dev.twitch.com/u/TheUKDude)\ **Post date:** [September 5, 2026, 7:21pm UTC](https://discuss.dev.twitch.com/t/if-your-twitch-extension-local-test-suddenly-started-throwing-a-cors-error/64438/7 "2026-09-05T19:21:03Z")
> [@jompoh](#): > > For now, set chrome://flags/#local-network-access-check to `disabled`. > In Firefox set `network.lna.blocking` in about:config to false, or use `network.lna.skip-domains`. > This was the default a year ago. Yeah I just added `.twitch.tv,dev.local` for Firefox to get past that issue and added `dev.local` static domain on my local DNS and I haven’t had this issue since.