Safari Web Extension CORS Error in Background and Content Script

I'm converting a Chrome extension to work in Safari 15 using the xcrun safari-web-extension-converter. It partially works, but seems to fail with CORS permission issues in both the background script and content scripts.

Oddly enough neither issue exists in Chrome. I have granted all websites permission via Safari itself after installation.

In manifest.json, I have this in the permissions key:

"http://*/",
"https://*/"

I've tried a variety of permutations, including "https://*/*" but nothing works. Every XMLHttpRequest results in the same error:

Failed to load resource: Origin safari-web-extension://... is not allowed by Access-Control-Allow-Origin. Status code: 200

As mentioned, it works fine in Chrome with the same permissions. What have I missed?

Replies

We would need a sample project to be able to diagnose what is going wrong here.

Can you file a bug report at https://feedbackassistant.apple.com and include a sample extension? And then once you've done that respond here with the feedback ID?

Thanks!