Firefox blocks `/eval/` requests

[drewcorlin1]

Describe the bug
Non-anonymous eval requests (https://clientstream.launchdarkly.com/eval/<id>/<data>) are being blocked only in firefox (working fine in Chrome, Safari, Edge) with the error message below.

To reproduce
Make an identify() call with the LaunchDarkly client

Expected behavior
No error is logged in the console

Logs

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://clientstream.launchdarkly.com/eval/<id>/<data>. (Reason: CORS request did not succeed). Status code: (null).

SDK version
3.0.6

Language version, developer tools
Javascript/React with the sync LD provider

OS/platform
Mac OS Ventura 13.3.1 - Firefox 115.0.3 64 bit

Additional context
The anonymous identify call (seemingly triggered automatically by LD) is not blocked. Also the non-anonymous call that does throw an error seems to actually register the context in LaunchDarkly, so it might just be noise.

[yusinto]

@drewcorlin1 are you able to share more information about this please?

• Is this happening in dev only or in production or both?
• Please share some of the application code which shows your usage of the react sdk.
• Do live updates/streaming still work even with the error?
• Are you running any third party plugins in firefox that may cause the issue? Can you please try reproducing in incognito?
• Do you have enhanced protection settings turned on in firefox which may cause the issue?

[ToothpickFactory]

@yusinto

• This is happening in both production and dev
• The app still works despite these CORs issue errors being thrown
• This was run in clean version of Firefox and within incognito
• Enhanced protection is not on

[yusinto]

Thank you, we will investigate. Internally logged as 213182.

[drewcorlin1]

@yusinto is there any update on this?

[github-actions]

This issue is marked as stale because it has been open for 30 days without activity. Remove the stale label or comment, or this will be closed in 7 days.

[drewcorlin1]

Still hoping for a response here

[gdp2]

Is there any updates on this.

[ikhramtsov-st]

Still seeing this issue.

[joker23]

Hi - thanks again for the report

We've moved active development of the React SDK to the LaunchDarkly js-core monorepo. The successor package is @launchdarkly/react-sdk (v4, released 2026-04-30):

https://github.com/launchdarkly/js-core/tree/main/packages/sdk/react

New issues, including feature requests, should be filed against the js-core repo:

https://github.com/launchdarkly/js-core/issues/new/choose

I am happy to help with this issue but if it is a CORS issue then it usually require some security header settings from the server side (reference https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS/Errors)

I'm tagging this issue with waiting for feedback which will automatically close this issue if there is no activity in 90 days. If this issue is still relevant, please open a new issue against js-core and link back to this one -- we'll pick it up there. Thanks!

[github-actions]

This issue is marked as stale because it has been open for 30 days without activity. Remove the stale label or comment, or this will be closed in 7 days.