Skip to content
Coursebox Support home
InboxAsk a human

SCORM blank screen in enterprise LMS — driver blocked by firewall/CDN

Problem

Some enterprise LMS deployments (for example SAP SuccessFactors) may show a blank screen when launching a SCORM package hosted on Coursebox. The browser console shows errors like “ScormXDDriver is not defined” or a blocked request for /assets/scripts/scormxd-driver.min.js.

Cause

  • Enterprise firewall, antivirus or proxy blocking cross-origin requests to the Coursebox driver script.

  • Edge/CDN or WAF rules on the Coursebox side returning 403 for cross-origin driver requests.

  • CSP/CORS restrictions applied by the LMS or network that prevent the runtime fetch of external scripts.

How to diagnose

  • Open browser developer tools on the learner’s device and check the Console and Network tabs.

  • Look for a failed request to https://<your-coursebox-domain>/assets/scripts/scormxd-driver.min.js with status 403 or CORS/CSP errors.

  • Capture the request/response headers (especially referer, status, Content-Type and any edge headers like X-Direct-Response).

Workarounds

  • Ask the customer IT/security team to whitelist the Coursebox domain (example: aimindset.coursebox.ai) in their firewall/proxy/CSP allow-list.

  • Bundle the driver locally inside the SCORM zip (reference it with a relative path) so the LMS does not need to fetch the script cross-origin.

  • Use a self-hosted SCORM export (fully-contained ZIP) to avoid any runtime calls back to Coursebox; note some live features (AI Tutor, text-to-speech, certain quizzes, and discussions) that require a live connection will not be available in this export.

Recommended engineering actions

  • Confirm whether any edge/CDN/WAF rules are returning 403 for cross-origin requests to the driver asset and remove or adjust the rule for LMS origins.

  • Document the exact trigger condition for the 403 so customers and partners can assess exposure across LMS platforms.

  • Make the driver asset available for cross-origin requests from trusted LMS referers or consider a CORS policy that permits trusted LMS hosts.

  • Improve client-side resilience: cache session-stable bootstrap config, add retry-with-backoff on 429/403 for bootstrap and search endpoints, and surface user-facing errors instead of blank pages.

What to provide when contacting support

  • Network capture (developer tools Network tab) showing the failing request and response headers.

  • Console output showing the error (e.g. ScormXDDriver is not defined).

  • Which LMS and instance (e.g., SAP SuccessFactors / plateau.com) and whether the course previously worked.

Need help?

Contact Coursebox Support with the network capture and console logs. If possible, provide a test account in the customer LMS or schedule a short debug call with the customer IT representative to reproduce the issue live.