@kariboka @robbystk

ejabberd. It's quite possible I didn't configure it properly. Looking at the config yml I notice I did have CORS headers setup for mod_http_upload, but that may not have been the only place they were needed. I'm guessing (in retrospect) they were probably required for mod_bosh, or maybe there's a global setting. If you happen to know off hand, I'd appreciate the clue and may give it another shot at some point.

Fyi, I had everything else working fine. Just couldn't get conversejs to play nice when self-hosting on the server. Worked fine as a standalone HTML though.