Using this simple snippet:

fetch(".xml?channel_id=UCAL3JXZSzSm8AlZyD3nQdBA", { mode: "no-cors" })
  .then(r => {
    console.debug(r);
    r.text().then(t => console.debug(t)).catch(console.error);
  })
  .catch(console.error);

I receive an empty response (null body, empty url, status of zero, ok is false), however when I go to the Network tab, I can see the data in the Response tab within it. I expect fetch response to give me the same.

What gives? I've tried adding credentials: "include" but it didn't make a difference and shouldn't, this resource should be accessible without it.

Using this simple snippet:

fetch("https://www.youtube./feeds/videos.xml?channel_id=UCAL3JXZSzSm8AlZyD3nQdBA", { mode: "no-cors" })
  .then(r => {
    console.debug(r);
    r.text().then(t => console.debug(t)).catch(console.error);
  })
  .catch(console.error);

I receive an empty response (null body, empty url, status of zero, ok is false), however when I go to the Network tab, I can see the data in the Response tab within it. I expect fetch response to give me the same.

What gives? I've tried adding credentials: "include" but it didn't make a difference and shouldn't, this resource should be accessible without it.

• javascript
• fetch-api

Share Improve this question Follow asked Nov 9, 2016 at 22:08 Tomáš HübelbauerTomáš Hübelbauer 10.8k1717 gold badges7474 silver badges141141 bronze badges 6

• 3 it's because youtube doesn't want you to fetch resources like that, they do not send CORS headers, so you can't get the resource into a browser directly - if you remove {mode: 'no-cors'} you'll see the CORS error - read what mode no-cors actually means here – Jaromanda X Commented Nov 9, 2016 at 22:19
• Why does the network request go through, though? It is an RSS feed, shouldn't I be able to just GET it? – Tomáš Hübelbauer Commented Nov 9, 2016 at 23:06
• 1 the request goes through because it's the response headers that control CORS - so you have to get a response to know if CORS is enabled for the site. You can see the response body in the console because there's no security issues with seeing the response body in the console, as you can just open the page anyway, right. The fact that it's an RSS feed is irrelevant - youtube clearly don't want browsers that are viewing other sites to directly access their RSS resources. You need to "proxy" the request on your server – Jaromanda X Commented Nov 9, 2016 at 23:15
• Aha. Okay. Can you answerize the ment for me to accept it? – Tomáš Hübelbauer Commented Nov 9, 2016 at 23:25
• no need, I think it's been covered plenty of times on SO – Jaromanda X Commented Nov 9, 2016 at 23:27

 |  Show 1 more ment

1 Answer 1

Sorted by: Reset to default 8

I will answerize because it helped me :)

the request goes through because it's the response headers that control CORS - so you have to get a response to know if CORS is enabled for the site.

You can see the response body in the console because there's no security issues with seeing the response body in the console, as you can just open the page anyway, right.

The fact that it's an RSS feed is irrelevant - youtube clearly don't want browsers that are viewing other sites to directly access their RSS resources. You need to "proxy" the request on your server