Facebook JS SDK CORS problems
<p>I'm working with Facebook js SDK "Go Live Dialog" for live streaming, every thing works fine until the last step when I want to publish the stream and I can't publish because there is a CORS error, it is:</p>

<blockquote>
  <p>XMLHttpRequest cannot load <a href="https://graph2.facebook.com/v2.5/10154376393778843?access_token=EAAOAPyi8mX....&amp;suppress_http_code=1" rel="nofollow noreferrer">https://graph2.facebook.com/v2.5/10154376393778843?access_token=EAAOAPyi8mX....&amp;suppress_http_code=1</a>. Response to preflight request doesn't pass access control check: The 'Access-Control-Allow-Origin' header contains multiple values '*, <a href="https://www.facebook.com/" rel="nofollow noreferrer">https://www.facebook.com/</a>', but only one is allowed. Origin '<a href="https://www.facebook.com/" rel="nofollow noreferrer">https://www.facebook.com/</a>' is therefore not allowed access.</p>
</blockquote>

<p>the issue is due to graph2.facebook.com is sending CORS header twice:</p>

<blockquote>
  <p>Access-Control-Allow-Origin: *</p>
  
  <p>Access-Control-Allow-Origin: <a href="https://facebook.com/" rel="nofollow noreferrer">https://facebook.com/</a></p>
</blockquote>

<p>and Google Chrome accepts only one.</p>

<p>I opened it as a <a href="https://developers.facebook.com/bugs/260047391080232" rel="nofollow noreferrer">bug on facebook</a> but until now their answers is to "disable CORS security" on my browsers, <strong>a bad solution if I want to make my app public for every one.</strong></p>

<p>The code for the app is this:</p>

<pre><code>&lt;script&gt;
window.fbAsyncInit = function() {
FB.init({
  appId      : '452751035113070',
  xfbml      : true,
  version    : 'v2.8'
});
};

(function(d, s, id){
 var js, fjs = d.getElementsByTagName(s)[0];
 if (d.getElementById(id)) {return;}
 js = d.createElement(s); js.id = id;
 js.src = "//connect.facebook.net/en_US/sdk.js";
 fjs.parentNode.insertBefore(js, fjs);
 }(document, 'script', 'facebook-jssdk'));
 &lt;/script&gt;
 &lt;button id="liveButton"&gt;Create Live Stream To Facebook&lt;/button&gt;
 &lt;script&gt; 
 document.getElementById('liveButton').onclick = function() {
 FB.ui({
 display: 'popup',
 method: 'live_broadcast',
 phase: 'create',
 }, function(response) {
 if (!response.id) {
  alert('dialog canceled');
  return;
 }
 console.log('stream url:' + response.secure_stream_url);
 FB.ui({
  display: 'popup',
  method: 'live_broadcast',
  phase: 'publish',
  broadcast_data: response,
 }, function(response) {
 console.log("video status: \n" + response.status);
 });
 });
 };
 &lt;/script&gt;
</code></pre>

<p>also here here: <a href="https://plnkr.co/edit/Aq0hkCTh5suXfOl6qKuN?p=preview" rel="nofollow noreferrer">https://plnkr.co/edit/Aq0hkCTh5suXfOl6qKuN?p=preview</a> .
To make a real try you should start an streaming using wowza or similar, if not, the publish button is disabled and the problem occurs when I click the publish button. </p>

<p>did someone know how to handle it to allow all users to use the script and to force them to use other browsers or to disable the security options? or I need to wait until facebook fix it?</p>