106

Because the proper HTTP Host header is often required to actually get the intended site. It's very common to host multiple web sites on the same IP address and distinguish between them based on the HTTP Host header specified by the client (as well as the TLS SNI value nowadays in the case of HTTPS). That is, when you entered http://example.com into your ...


49

You're making two requests for the same object, one from HTML, one from XHR. The second one fails, because Chrome uses the cached response from the first request, which has no Access-Control-Allow-Origin response header. Why? Chromium bug 409090 Cross-origin request from cache failing after regular request is cached describes this problem, and it's a "...


41

Going through the Google forums, it seems like Google doesn't have any intention of "fixing" this behavior. Issue seems like that the service starts and then it stops quickly making Windows think it failed, though in reality it checks for updates (and may be other "stuff") and exits with no errors. Since this is normal behavior, what I did was to remove the ...


23

CloudFront uses SNI, a way of being able to use multiple certificates on a single IP. All modern browsers support this, as does openssl's s_client command, but s_client doesn't magically do this. You have to tell it to use it: openssl s_client -servername dlnmh9ip6v2uc.cloudfront.net -connect dlnmh9ip6v2uc.cloudfront.net:443 -showcerts


22

Google Chrome stores the default user preferences in a master_preferences file. This is a text file in JSON format, and it includes a distribution object containing settings that will be read during installation. Editing this file in an existing Chrome installation does not solve the problem because the installation has obviously already occurred at that ...


19

Http/2 requirements as per https://http2.github.io/http2-spec/#rfc.section.9.2.2 : 9.2.2 TLS 1.2 Cipher Suites A deployment of HTTP/2 over TLS 1.2 SHOULD NOT use any of the cipher suites that are listed in the cipher suite black list (Appendix A). Endpoints MAY choose to generate a connection error (Section 5.4.1) of type INADEQUATE_SECURITY if ...


18

Chrome has an awesome built-in diagnostic tool, "about:net-internals", which is designed to help troubleshoot network problems. In particular, it has an "Events" tab which lets you specify a URL and then Chrome breaks down the entire process of loading it, step-by-step, including DNS resolution, cache hits, and AJAX element requests.


17

You need to provide the entire certificate chain in order for it to show up as trusted. Here's the link I got for comodo's instructions on installing the cert chain in apache: https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/637/37/certificate-installation-apache--mod_ssl I got this from http://www.sslshopper.com/ssl-checker.html#...


14

Because usually web servers use "virtual server" technology and are able to answer on your HTTP request within exactly the domain name you request, but not the IP address of the web servers. Thanks to hiding more than one domain name on one IP address. For example, the Apache web server is able to respond to your HTTP request with an IP address using the ...


13

So now I am unable to support the business requirement of supporting Chrome traffic, and unable to skirt around the unapproved software policy. This is a social problem, so there isn't a sane technical solution to it. (You can obviously do things that violate the security policy, and risk end up getting you fired or reprimanded, or that don't deliver on ...


12

The reason is explained on StartCOM's forum: https://forum.startcom.org/viewtopic.php?f=15&t=15929&p=21716 And on Chrome's: https://code.google.com/p/chromium/issues/detail?id=473105 It is indeed SHA1. It's due to Windows' or Chrome's certificate cache. Because they (old and new intermediary cert) have the same name, the client will use the ...


12

As per my answer on StackOverflow: Will likely be one of two reasons: You are using anti-virus software and it is MITM your traffic and so downgrading you to HTTP/1.1. Turn off https traffic monitoring on your AV to connect directly to the server. You are using older TLS ciphers and specifically one that Chrome disallows for HTTP/2 (https://http2.github.io/...


10

I can't help you with group-policy, but each extension includes its update URL in manifest.json. So, for the current version of adblock (id: gighmmpiobklfepjocnamgkkbiglidom): %USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.14_0\manifest.json Contains: "update_url": "http://clients2.google.com/...


10

In Apache, you can host many websites using just one single IP address. This is called virtual hosting. It's how subdomains can be created, even standalone domains. This is done by setting up an Apache configuration file containing VirtualHost directives for each domain/subdomain. An example HTTP server that has two virtual hosts, example1.com and example2....


10

I suspect it’s this: # Avoid mime type sniffing add_header X-Content-Type-Options: nosniff; HTTP/2 is a bit more strict about HTTP Headers than HTTP/1.1 was and in this header, unlike your others, you have included a colon in the header name which is a mistake. This leads to a double colon in the output: X-Frame-Options: SAMEORIGIN X-Content-Type-Options::...


9

Chrome supports SNI, telling the server which certificate to send. The s_client command doesn't. There's more details of CloudFront's usage of SNI here. When you use SNI Custom SSL, some users may not be able to access your content because some older browsers do not support SNI and will not be able to establish a connection with CloudFront to load the ...


8

tl;dr Check how Chrome handles certificate checking and revocation. We had a very similar issue at a facility I previously worked at, but with Firefox. For this to be an issue, you need to confirm the issue is only with https pages. If not, it will make little difference. With Firefox (I know, I know, I can read, point forthcoming), a bunch of people had ...


8

Take a look here: http://support.google.com/installer/bin/answer.py?hl=en&answer=146164 That gives you information on configuring GPOs to disable the built-in auto-updating feature of Chrome, etc. Then take a look here: http://www.google.com/apps/intl/en/business/chromebrowser.html That is the "Chrome for Business" page. There is a link on that page ...


8

Bug in chrome: http://code.google.com/p/chromium/issues/detail?id=103458


8

I didn't find the information anywhere, but chrome shows alert in chrome://net-internals/#events tab with description : "PAC_JAVASCRIPT_ALERT". Also you can find what chrome use as proxy in tab : chrome://net-internals/#proxy


8

I like to use the "house" terminology. You can quite easily send a letter to a house without a name on it and it'll arrive at the house. If you put the person's name on it then you're sending to the intended recipient. The destination is the same but how it is handled when it reaches the house is different. When you specify the site, i.e. www.example.com ...


7

Did about an hour searching on the internet before I asked this question. But after asking it I did just another search giving the answer :-), matter of finding the correct keywords. Here the answer: https://stackoverflow.com/questions/5724377/mvc3-site-using-azure-acs-adfs-continually-prompts-for-credentials-when-using


7

As @JScott suggested, I just changed the service from Automatic Delayed to Manual (or I could have also chosen Disabled). And .. that fixed it.


6

When you installed chrome it most likely added a file in /etc/apt/sources.list.d/ named google-chrome.list. You should remove the line you manually added, and just keep the file that is in there, which is what the chrome package uses.


6

This is a bug in Chrome. You can see in the code that Chrome maintains a list of registry controlled domains and that it needs updated as each gTLD is added. You can see in the effective_tld_names.dat file that the .care domain is not listed, though its listed for other browsers that use a more recent version of the Public Suffix List. This is what causes ...


5

What I've seen most often is that restrictions like these arise not only out of a desire for conformity, consistency, and easy support, but also because of compliance or reporting requirements. While IT can choose to make exceptions to their own rules on the former category, the latter is more often rooted in forces outside of the IT department itself. ...


5

Did you also look at the following setting for Firefox? http://markmonica.com/2007/11/20/firefox-and-integrated-windows-authentication/ Navigate to about:config Search for network.automatic-ntlm-auth.trusted-uris Add your URIs. Separate multiple entries with commas.


5

I don't have an answer why, but I also observed the same behaviour. I documented my findings here. http://app-inf.blogspot.com/2012/09/browser-load-balancer-web-server-mod-jk.html There may not be a way to change IE to send Keep-alive signals, but we changed a setting on the load balancer "Keep Alive Interval" to maintain the connection. Hopefully this ...


5

Chrome has group policies for deployment. I just started rolling it out in our org and there is a setting in their group policy templates to have it automatically import favorites without user intervention. It also lets you set whether or not it should become the default browser, automatically install extensions, and set a whole host of other settings. It ...


5

Google has a set of group policy templates available. That would be the best way to enforce the settings you want on either the machine or user level. Downloads for the ADM template can be found here and more details on the actual policy objects that can be set is found here.


Only top voted, non community-wiki answers of a minimum length are eligible