Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cors]

Cross-Origin Resource Sharing (CORS) is a specification that enables open access across domain-boundaries

0
votes
0answers
13 views

apache Header set Access-Control-Allow-Origin not working

I've added the following line to a virtual host secion <IfModule mod_headers.c> Header set Access-Control-Allow-Origin "*" </IfModule> a page hosted on this site issues a ...
0
votes
0answers
35 views

Amazon S3 CORS - No 'Access-Control-Allow-Origin' header is present on the requested resource

I'm getting the following error when loading an asset via CloudFront Access to image at 'https://example.com/assets/image.png' from origin 'https://localhost:3000' has been blocked by CORS policy:...
0
votes
1answer
124 views

Multiple CORS origins. Should I use if statement? - NginX

I have set up an NginX in order to serve some static files from an instance. The static files are to be used by 3 different domains that I own. The NginX server is on its own (4th) domain. I want ...
1
vote
1answer
46 views

I want to add Apache Alias for api (Different users)

First of all i'm a beginner on these issues, sorry for this :) Actually i am a software developer. I have a project. Many domains connect to Rest Api domain. And all domains locate same server. I ...
0
votes
0answers
16 views

CORS header increases webpage size but loads at twice the speed

Experiencing some errors in Chrome, i decided to add some configuration to fix CORS issues on my website. So i added the CORS allow-origin-header for my origin source only, for my website to load ...
0
votes
1answer
178 views

IIS10 Cors Module Configuration to Allow Cors

I'm having an issue allowing CORS requests on IIS v10 with an 2016 windows azure server. I downloaded and installed the IIS Cors module that is supposed to help take care of this, but I can't seem to ...
-1
votes
1answer
151 views

Aws s3 object acl everyone read access denied

I have upload one image but its not publicly accessible. I have granted full AWS s3 permission for the user. My canonical user id 9ebb86750cf9111e69a4c95e1c3c53062209080c56399ddc7919be48897cf25f. Same ...
1
vote
1answer
101 views

Cannot set CORSEnabled and CORSTrustedOrigins properties on ADFS 2019

The Problem: There are properties in ADFS 2019 that indicate that you can enable CORS Headers for the ADFS Login Page and set the allowed origins. Get-AdfsProperties CORSEnabled ...
0
votes
0answers
132 views

How to use CORS headers on Nginx response for requests with files which exceeds the max size

I'm using nginx with php-fpm. Now i'm developing a file upload feature and i would like to set the file size limit on Nginx so it won't upload the entire file if it exceeds the maximum size, but when ...
0
votes
0answers
94 views

Nginx only serves an empty response with 200 status code after i started to use CORS configuration

I'm trying to use wide-open CORS configuration for Nginx. Since i started to use this configuration Nginx only serves an empty response with 200 status code. I'm using Nginx with PHP-FPM. I have ...
0
votes
1answer
235 views

How to config nginx to include headers into response?

I have nginx which proxies requests to app server browser <=> nginx <=> app_server. For some reason not all headers provided by app_server will be returned to the browser. I.e. headers ...
1
vote
0answers
312 views

Nginx, PM2, Node - No 'Access-Control-Allow- Origin' header

I have developed NodeJS server ran with express. I use PM2 to manage the application and then nginx to proxy requests to the application. My Express application has CORS, CSP etc set up. But, the ...
0
votes
0answers
261 views

AWS Lambda: Using CORS & Lambda proxy to expose cloudfront signed cookies

I'm building a full javascript app from Salesforce.com API with no server side script that will be hosted on salesforce.com domain (https) This app should be able to grant access to multiple files ...
0
votes
2answers
2k views

Did I implement CORS at the wrong place?

I have problem concerning CORS. I always get rejected from a clients api (Console error at the end of article). Now I'm wondering if its my fault at all. I hope to find the gap with your help. I got ...
0
votes
1answer
2k views

No 'Access-Control-Allow-Origin' header is present on the requested resource — But it is?

My /etc/apache2/sites-enabled/example.com.conf on a remote server looks like this... <VirtualHost *:80> ServerAdmin admin@example.com ServerName example.com ServerAlias ...
0
votes
1answer
765 views

Response from Cloudfront from S3 Origin keeps changing CORS Headers [duplicate]

here is my problem : CORS are set as supposed to be on the S3 : <CORSConfiguration> <CORSRule> <AllowedOrigin>*</AllowedOrigin> <AllowedMethod>GET</...
0
votes
2answers
1k views

Still get data even there is a CORS issue in Nginx

I'm trying to debug a CORS issue. Here's my configuration I'm using http://www.test-cors.org/ to test my Nginx rules. I get the message below in my browser's console when the method I use is OPTIONS. ...
1
vote
1answer
5k views

Nginx add headers and proxy_pass for CORS bypass

I want to make CORS site with API on proxy_pass server. But location / { if ($request_method = 'OPTIONS') { add_header 'Access-Control-Allow-Origin' '*'; add_header 'Access-...
1
vote
0answers
378 views

How can I set Access-Control-Allow-Origin for multiple domains in apache2?

I have created an app in React with its backend in Python Django. I hosted the React app in Heroku and the Django app in AWS (apache2). I have faced a problem with CORS. I added the following ...
0
votes
0answers
771 views

Cloudflare scrubbing Access-Control-Allow-Origin header when in Under Attack Mode

I need to be able to set the Access-Control-Allow-Origin response header with my server, however when I switch to Under Attack Mode (which I need right now because I'm being DDOSed), Cloudflare scrubs ...
0
votes
1answer
2k views

Enable CORS in Tomcat

SCENARIO: Frontend: Angular application living in NGINX Backend: java application living in Tomcat 8.5 The frontend needs to call backend Rest API. As far as I understand I need to allow CORS for ...
0
votes
0answers
70 views

nginx cors setup complaining about .global domains

I am quite new to nginx and wanted to setup a cors setup: I checked this website My problem is that nginx complains after restart because: nginx: [emerg] pcre_compile() failed: a numbered reference ...
3
votes
1answer
529 views

Disable authorisation on preflight OPTIONS request in HAProxy

We have a HAProxy setup which has basic auth on some of our backends. We now want to enable CORS requests to our backends but this is failing for those with basic auth enabled. When CORS makes it ...
2
votes
0answers
445 views

CORS not works on Nginx

I need my application work with backend API on other domain. I use nginx 1.12.1 on Ubuntu 16.04. I added to my host config following (to the location ~ .php$ section): add_header 'Access-Control-...
0
votes
2answers
542 views

webDAV and CORS

I see some strange behavior on my webServer. Trying to get keeWeb to accept a file from a webDAV share on a different server. If I want to add a WebDAV File which is entered in Form of: https://FQDN:...
25
votes
2answers
15k views

Chrome S3 Cloudfront: No 'Access-Control-Allow-Origin' header on initial XHR request

I have a webpage (https://smartystreets.com/contact) that uses jQuery to load some SVG files from S3 through the CloudFront CDN. In Chrome I will open an Incognito window as well as the console. Then ...
1
vote
0answers
375 views

best practice for Single-Page Applications to access API's to avoid CORS across domains

here is the setup: having a onpage app living on example.com which should access the API on the domain api.example.com via AJAX. due to the CORS restriction i cannot access the API directly with ...
1
vote
1answer
586 views

IIS6 Allowing CORS without Access-Control-Allow-Origin

I don't understand what is going on here. I've got two IIS6 Sites running on the same server. One is www.example1.com and the other is www.example2.com When looking at the HTTP Headers in Google ...
4
votes
1answer
1k views

What AWS service to avoid CORS issues with S3 static content and aws backends

Introduction I've got the following architecture deployed on Amazon AWS. The goal is to expose a web application (single page application) acting as an entrypoint at https://app.acmecorp.com. This ...
1
vote
2answers
811 views

How to add both CORS headers and Browser expired header in same conf

I need to add both expires headers AND allow cors in nginx If I add location ~* \.(ico|pdf|flv|jpg|jpeg|png|gif|js|css|swf|x-html|css|xml|js|woff|woff2|ttf|svg|eot)$ { expires 30d;} then the ...
0
votes
1answer
2k views

Access-Control-Allow-Origin does not match.. but it does

Nginx CORS error is not going away. I am using Debian Jessie and below is the and sites-available/reverse.conf Reverse.conf is the file i created for reverse proxy. I am getting this CORS error on ...
2
votes
1answer
1k views

nginx - CORS configuration that allows files to be served to localhost?

Here is my current nginx configuration file: server { listen 80 default_server; listen [::]:80 default_server; root /var/www/html; # Add index.php to the list if you are using PHP index index.html ...
1
vote
1answer
426 views

Changing to env:flex in app.yaml introduces a redirect

After receiving an email from google reporting that the vm: true configuration in appengine flexible environments should be replaced by env: flex, apps that use custom domains are now responding with ...
0
votes
1answer
810 views

NGINX Enable CORS for a Google Places API call

I would like to enable CORS for Google Places API in order to call it from an Ionic 2 app with a WkWebView. I am doing this in my nginx default config: server { listen 80 default_server; ...
2
votes
1answer
789 views

htaccess conditional header set is ignoring the condition

I'm trying to set headers if the origin is a particular site to solve a resource conflict I'm having (using Mautic hosted on a subdomain). If I add the headers for any situation I get a 500 error ...
1
vote
0answers
131 views

htaccess require host domain not working correctly

I have a folder full of folders with json files. I want to restrict AJAX requests to these files to certain domains. I made an htaccess file to restrict this but it isn't work. My htaccess is as ...
1
vote
2answers
2k views

Allowing all headers in CORS

I want to configure my Apache 2.4 to serve some static resources in a CORS-friendly way. I already have the following setting: Header always set Access-Control-Allow-Origin "*" However, for recent ...
1
vote
0answers
2k views

nginx: CORS headers are not added for OPTIONS request

Consider this minimal nginx server configuration server: { listen 80; server_name myserver; location / { add_header 'Access-Control-Allow-Origin' '*'; add_header 'Access-...
0
votes
1answer
774 views

Passing client's (browser) certificate to downstream proxy - is that possible?

I got the following issue: A browser send a CORS request to a server - this server requires client SSL/TLS authentication (so both, server and client should exchange their certificates). The server is ...
4
votes
0answers
737 views

S3/Cloudfront CORS working on some files only

I'm really struggling to get Cloudfront and S3 to add Access-Control-Allow-Origin: * to the headers of video files stored on S3 (for inline video on iPhones - seems to be working everywhere else ...
1
vote
0answers
860 views

Apache 2 responding with 301 redirect on OPTIONS request

I'm trying to get my Angular 2 application running and everything is going relatively smoothly until I hit the API for some data. Apache is responding with a 301 redirect when Angular's http module ...
3
votes
1answer
214 views

Amazon CloudFront CORS specific delay

I am experiencing a delay between the serving of CORS requests but direct requests are served fine. I am using this to distribute media streams via HTTP so it is very important to reduce the startup ...
1
vote
1answer
848 views

Fix headers in nginx with CORS and http/2

I have been working on my nginx config for a while now but somehow I seem to have a mixup with my headers. I got http/2 running with nginx 1.9.12 on ubuntu 14.04 and am getting a solid A rating. ...
1
vote
1answer
819 views

Zimbra and cross-origin framing

Let's say that I have a Zimbra webmail accessible at https://mail.example.com. I also have a web app at https://app.example.com. On one of the app's pages I am trying to embed the webmail: <iframe ...
0
votes
0answers
1k views

How can I use CORS with tomcat6?

How do I install and enable CORS for Tomcat 6? There is lots of documentation out there for Tomcat 7 or later, and lots assuming you already have the CORS filter jar file, but none that start with ...
1
vote
1answer
4k views

Adding subdomains in haproxy for CORS

I want to do the equivalent of this in haproxy to allow CORS for any server in my domain. By default CORS only does null, star or a single URL. Is that possible? SetEnvIf Origin "^(.*\.bebop\.co)...
1
vote
1answer
628 views

Appending an argument to request_uri for mobile subdomain on nginx

I'm running a multilingual wiki (MediaWiki 1.26.2 with MobileFrontend) on nginx 1.9.3/OpenBSD 5.8. For each language wiki, I have a separate MediaWiki installation folder and a subdomain like en....
0
votes
1answer
905 views

Using URL Rewrite and ARR for redirecting to same server

The scenario: A web server running a single site under two different addresses: www.mysite.com (regular site) ws1.mysite.com (web services) Both are accessible via HTTPS, and both are running on the ...
2
votes
2answers
3k views

How can I replace Access-Control-Allow-Origin header in proxy response with nginx

I am using a simple nginx instance to proxy REST calls to another server. The purpose of my proxy is to allow the use of cookies for authentication. I have it working, except for one problem. The ...
0
votes
0answers
51 views

Are blocked requests by S3 CORS billable?

I'm getting a large amount of POST requests to my S3 bucket. Ideally I'd like to block them all, so I've been looking into CORS. If a request is being blocked by the CORS policy, do I still pay for ...