I updated DXPR builder to 2.8.1 and I noticed that the images for the editor are not loading. I see this console error:

Access to image at 'https://cdn2.dxpr.com/2.8.1/images-backend/glyphicons-halflings-107-save...' from origin 'https://emergencymedicine.vumc.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

glyphicons-halflings-107-save.svg:1 Failed to load resource: net::ERR_FAILED

CommentFileSizeAuthor
Screenshot 2026-08-27 at 1.07.37 PM.png4.08 MBjo13sue

Comments

jo13sue created an issue. See original summary.

drale01’s picture

drale01 commented
Status: Active » Postponed (maintainer needs more info)

I tried to reproduce this on Drupal 11.4.5 with DXPR Builder 2.8.1, using Cloud assets (cdn2.dxpr.com/2.8.1/). The editor UI loads, including the toolbar icons. The Save control uses https://cdn2.dxpr.com/2.8.1/images-backend/glyphicons-halflings-107-save... via CSS mask-image. That request currently succeeds and the CDN responds with Access-Control-Allow-Origin: *, so I am not seeing the CORS error from this report.

Please retest on 2.8.1 with a hard refresh (or a private window) while logged in as an editor, with the DXPR Builder UI open (hover the content so the toolbar is visible). Then reply with:

  • Do the editor icons still fail (Save, plus, preview, etc.) after a hard refresh?
  • A screenshot of the editor toolbar with the missing icons
  • The full console error, including the exact image URL
  • From DevTools → Network, the failing images-backend/*.svg request: status code, and whether the response includes Access-Control-Allow-Origin
  • Browser and OS
  • Drupal version
  • Configuration → DXPR Builder: Asset source (Cloud vs Local), if that setting is visible
  • Whether you are behind a proxy, WAF, or firewall that might strip CORS headers from cdn2.dxpr.com
  • Whether the same CORS error appears for other users/browsers on the same site

CORS / third-party errors on the public homepage (analytics, video embeds, marketing scripts) are unrelated. We need the error from an authenticated editor session with the DXPR Builder toolbar on screen.