‘Access-Control-Allow-Origin’ missing when uploading to YouTube API

Question

For several years we have successfully been uploading videos via the YouTube API using some custom JavaScript code. The code was based on some samples provided by Google (cors_upload.js). It's not something we use a lot, just every couple of weeks.

Things were working fine a couple weeks ago, but it has come to my attention that things recently stopped working. We login fine, we obtain the channel info fine. But when we start the upload (which happens via XHR POST), we are getting a CORS error:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://www.googleapis.com/upload/youtube/v3/videos?part=snippet%2Cstatus&uploadType=resumable. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).

But we haven't changed anything in our code or on our server and it appears as if we are doing all the things necessary as documented by Google to have their service respond with the required CORS headers.

According to the dev console, the XHR request actually generates 2 network requests. First I see an "OPTIONS":

Request URL:https://www.googleapis.com/upload/youtube/v3/videos?part=snippet%2Cstatus&uploadType=resumable
Request Method:OPTIONS
Remote Address:172.217.9.42:443

This actually DOES return the "access-control-allow-origin" header that I expect. However, this is immediately followed by the "POST" request:

Request URL:https://www.googleapis.com/upload/youtube/v3/videos?part=snippet%2Cstatus&uploadType=resumable
Request Method:POST
Remote Address:172.217.9.42:443

And according to the dev console, it does NOT have the "access-control-allow-origin" header set. So, I understand why my browser is rejecting things. It just seems like Google broke something.

我确实在我们管理的服务器上成功部署了 NodeJS“CORS Anywhere”服务器。所以，我可以用它来解决这个问题。但这确实不是解决问题的正确方法。由于以编程方式上传视频不是我们经常做的事情，因此这项工作对我们来说可能就足够了。我很想知道出了什么问题或如何解决。因此，如果有人使用 YouTube API 和 JavaScript 成功上传视频，我很想知道。如果/当他们遇到问题时，希望这将有助于教育其他人。

Answer 1

我的服务刚刚开始出现同样的问题。

这似乎是 googleapis 上的一个错误，或者可能是 youtube.v3.apis 发生了策略更改并开始阻止某些客户端。