[Extension] RPC preflight 403 — x-client-locale missing from Access-Control-Allow-Headers → "Failed to generate a valid transaction" when Site Access ≠ "On all sites"

[sponomarev]

Summary

This is a backend CORS configuration bug on solana-mainnet.phantom.app, not a user-side issue.

When the extension's Chrome Site Access is set to anything other than "On all sites", Chrome revokes the *.phantom.app host permission, so popup fetches become regular cross-origin requests and go through a CORS preflight. The preflight OPTIONS to solana-mainnet.phantom.app is rejected with 403 because the extension sends x-client-locale, and that header is not in the proxy's Access-Control-Allow-Headers list. Every RPC call fails with net::ERR_FAILED and the UI shows "Failed to generate a valid transaction" indefinitely.

With "On all sites" Chrome skips CORS entirely, so the mismatch is invisible in the default configuration — it only surfaces for users who restrict Site Access (a standard privacy setting).

Fix: add x-client-locale to Access-Control-Allow-Headers on the RPC proxy (and any other *.phantom.app endpoint the extension calls with this header). Ideally generate the allow-list from the same source as the client header set.

Possibly the same class of edge-config issue as #515 (403 from the edge in front of a Phantom API), though I haven't verified that.

Example

Not site-specific — reproduces inside the extension popup itself (swap/send), no dApp involved.

Steps to Reproduce

1. Chrome → right-click Phantom icon → "This can read and change site data" → select "When you click the extension" (or "On ").
2. Open the Phantom popup, start a swap or send.
3. Observe: UI shows "Failed to generate a valid transaction".

DevTools (inspect popup) → Console:
POST https://solana-mainnet.phantom.app/?advancedTxSubmission=true net::ERR_FAILED
Access to fetch at '...' from origin 'chrome-extension://bfnaelmomeimhlpmgjnjophhpkkoljpa' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status.

DevTools → Network → the OPTIONS preflight:
Status: 403 Forbidden (remote 104.18.35.227, Cloudflare)
Origin: chrome-extension://bfnaelmomeimhlpmgjnjophhpkkoljpa
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,solana-client,x-client-locale,x-phantom-anonymousid,x-phantom-platform,x-phantom-version,x-phantomauthtoken,x-phantomnonce

Server's allow-list (from a passing preflight):
access-control-allow-headers: accept,authorization,connection,content-type,solana-client,traceparent,tracestate,upgrade,x-datadog-origin,x-datadog-parent-id,x-datadog-sampling-priority,x-datadog-trace-id,x-phantom-anonymousid,x-phantom-method,x-phantom-platform,x-phantom-version,x-phantomauthtoken,x-phantomnonce,x-pool
→ x-client-locale is absent.

Isolated with curl (same Origin, ACRM: POST):
Access-Control-Request-Headers: content-type,x-client-locale → 403
Access-Control-Request-Headers: content-type,x-phantom-version,x-phantomnonce → 204 with matching ACAO

Repro command:
curl -sS -o /dev/null -w '%{http_code}\n' -X OPTIONS
'https://solana-mainnet.phantom.app/?advancedTxSubmission=true'
-H 'Origin: chrome-extension://bfnaelmomeimhlpmgjnjophhpkkoljpa'
-H 'Access-Control-Request-Method: POST'
-H 'Access-Control-Request-Headers: content-type,x-client-locale'

Workaround: set Site Access back to "On all sites".

Phantom Version

Chrome extension 26.28.1, Chrome 152.0.0.0, macOS

Is there an existing discussion for this?

• I have searched the existing discussions

[Th3Ya0vi]

Please reach out to Phantom Support for assistance with this issue. Thanks!