For our universal login, we host the custom logo in an AWS S3 bucket. Only certain URLs are allowed to access files in it. All relevant Auth0 pages it would be called on are in the whitelist, but the URL has to be in the referrer of a get request. The issue is on our universal login page, sometimes the GET request for the image will fire, but with no referrer. See bellow:
GET /ottertune-logo-horizontal-black-transparent.png HTTP/1.1
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9
Connection: keep-alive
Host: ottertune-auth0-files.s3.us-east-2.amazonaws.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "macOS"
However, after refreshing multiple times, a request with a referrer is fired and the image loads successfully:
What is going on that makes it so that there’s no referrer the first time?