Hi there. This is essentially a duplicate of this ticket: https://community.hubspot.com/t5/CMS-Development/Firefox-No-CTAs-No-Hubspot-Videos-Same-origin-policy-CORS/m-p/767349
My website is also having the same issue, but the above ticket solution is simply to “create a support ticket and take it further”.
I would love to know if there is a solution to this issue.
From what i’ve read, it sounds like Hubspot needs to add a access-control-allow-origin header, but I may be mistaken.
```
curl -IkL https://js.hubspot.com/web-interactives-embed.js
HTTP/2 200
date: Wed, 02 Jul 2025 18:17:22 GMT
content-type: application/javascript; charset=utf-8
x-amz-replication-status: COMPLETED
last-modified: Tue, 01 Jul 2025 14:16:14 UTC
x-amz-server-side-encryption: AES256
x-amz-version-id: W6JzmoMHgz.0o2yStQpgpl3bJupDrEHe
etag: W/“4c835a30bcf213b0137eec92c938c0be”
vary: accept-encoding
x-cache: Hit from cloudfront
via: 1.1 c13d71f8919c23db6bbd1c08a4dfb350.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD12-P3
x-amz-cf-id: BHNUk3NzDwVwaqaHD2tSszp7l5gwdBVgGNjHJ19sT52rUPFAI7rMFA==
content-security-policy-report-only: frame-ancestors ‘self’; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.3865/bundles/project.js&cfRay=95869448ed66a4f4-ORD
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.3865/bundles/project.js
x-content-type-options: nosniff
access-control-allow-origin: *
x-hs-cache-status: MISS
x-envoy-upstream-service-time: 7
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: 6b7bc4c5-730e-4ed2-8041-719db9522e03
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-554d564d77-bctgl
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-request-id: 6b7bc4c5-730e-4ed2-8041-719db9522e03
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
cf-cache-status: HIT
age: 528
set-cookie: __cf_bm=L_CWy0UZMysk49Vw1IcywnLk53ieswqkvseNjL9Sgow-1751480242-1.0.1.1-_TeUVR7bovd2PNNZ3C6jIumnIZt8kOxFZR48Q8nK8kk0yjjzXRinHbBiM8GZfdEtBsO7nhSeGWTrmRcrdyV8awz_UalVRRqOnPZmpuhRIqQ; path=/; expires=Wed, 02-Jul-25 18:47:22 GMT; domain=.hubspot.com; HttpOnly; Secure; SameSite=None
report-to: {“endpoints”:[{“url”:“https:\/\/a.nel.cloudflare.com\/report\/v4?s=OeoBAZI0x2Y6OdTHw3aVAgUHlT0HkozkgXHkPlTdzW3gmHBUygyzJUAxmeiUoKW%2BIZ9q0604DSsuWULRI5cr8Lk3Yt1YSTv2zRpyKNlp1x3Am4K57NLRi7HjVBwmFPyA”}],“group”:“cf-nel”,“max_age”:604800}
nel: {“success_fraction”:0.01,“report_to”:“cf-nel”,“max_age”:604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
set-cookie: _cfuvid=BOT2fJzTviKsAThuenqNvBj_qFCCQcOgOkyuDtZqm74-1751480242416-0.0.1.1-604800000; path=/; domain=.hubspot.com; HttpOnly; Secure; SameSite=None
server: cloudflare
cf-ray: 959023bb082983b0-MSP
```
```
curl -IkL https://js.hscollectedforms.net/collectedforms.js
HTTP/2 200
date: Wed, 02 Jul 2025 18:20:30 GMT
content-type: application/javascript; charset=utf-8
x-amz-replication-status: COMPLETED
last-modified: Wed, 11 Jun 2025 10:10:11 UTC
x-amz-server-side-encryption: AES256
x-amz-version-id: 9d4vq9ts.bFZV77tVlbNVqzuFhqIVFBF
etag: W/“d374e9efbf5e558327f9a1db866edc85”
vary: accept-encoding
x-cache: Hit from cloudfront
via: 1.1 16df6ade68382d048f8aad1f7e39da28.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD12-P3
x-amz-cf-id: Zf2gsRdLfo-YVNlmsawU9kavhqeJ9Xo4gdohpoeRWg1TK2NjCwjm9w==
content-security-policy-report-only: frame-ancestors ‘self’; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.2820/bundles/project.js&cfRay=94e06036b98dd679-IAD
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: collected-forms-embed-js/static-1.2820/bundles/project.js
x-content-type-options: nosniff
access-control-allow-origin: *
x-hs-cache-status: MISS
x-envoy-upstream-service-time: 7
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: 23bc9158-7fed-440c-82a3-3617ddc16b87
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-554d564d77-9tjgj
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-request-id: 23bc9158-7fed-440c-82a3-3617ddc16b87
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
cf-cache-status: HIT
age: 150
set-cookie: __cf_bm=JE_KPYybZQ10667V50jEemz1QnlLohwH8o90WM66M7Y-1751480430-1.0.1.1-Nj6NGiF4ZawyTJeUsvSQTLmEl82xxT_oXWFbUA9BrCnoWs8jt8411UAAtv27gLCQhL6bBgDheHBOzjgru5XoQXQwAV7Gh5vXDyEaEkUFfjo; path=/; expires=Wed, 02-Jul-25 18:50:30 GMT; domain=.hscollectedforms.net; HttpOnly; Secure; SameSite=None
server: cloudflare
cf-ray: 959028543ba0a1f4-MSP
```