Questions tagged [cors]

Cross-Origin Resource Sharing (CORS) is a specification that enables open access across domain-boundaries

Filter by
Sorted by
Tagged with
0
votes
0answers
16 views

Nginx cors configuration for 2 sub-domains with separate ssl

I have two apps running on my server. A react app on port 4512 (locally on HTTP) and 5512 (on https). Can be accessed on https://merchant.abc.com:5512 A node js (express) API on port 4511 (locally on ...
0
votes
0answers
8 views

On what server is the 'frame-ancestors' Content Security Policy managed?

I'm just trying to get clarification on the proper use of this. Assuming I have a website on server 'A' that intends to serve an i-frame of a page hosted by server 'B', but the request is being ...
0
votes
0answers
34 views

Nginx Cross-Origin Request Blocked

I have this error in my web page: "Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://www.cdn-example.com. (Reason: CORS header ‘Access-Control-Allow-...
0
votes
1answer
81 views

Installing CORS on Ubuntu 18.0.4 LTS

I want to install/use CORS on my Ubuntu server 18.0.4 LTS for the Wordpress websites that I am hosting. Normally I just add the line in the .htaccess but that doesn't seem to work anymore. Any ...
0
votes
0answers
24 views

Make ambassador edge stack intercept CORS preflight requests

Been struggling to make ambassador edge stack deployment to intercept pre flight requests on our kubernetes cluster. What we want to achieve is OPTIONS request -> Ambassador -> Reply to this OPTIONS ...
1
vote
0answers
44 views

CORS error despite CORS being enabled in app server and Nginx

I have a web application and server which is fully functional in a debugging environment, however when it's hosted for production, I get the following error in the browser console: Cross-Origin ...
0
votes
1answer
13 views

Access-Control-Allow-Origin header is not include in response when using a POST request

I have the following in my nginx config: location / { # CORS add_header 'Access-Control-Allow-Origin' '*'; add_header 'Access-Control-Allow-Methods' 'GET, POST' always; proxy_pass ...
0
votes
0answers
19 views

Nginx doesn't forward the OPTIONS request to application [duplicate]

I have an Nginx server and a PHP application running in PHP-FPM. The application is restful API. The problem is I get OPTIONS request which the application understands and supports, but the server ...
2
votes
0answers
516 views

firefox throws CORS error but works fine in chrome

I have set the following in apache RequestHeader edit "If-None-Match" '^"((.*)-(gzip|br))"$' '"$1", "$2"' SetEnvIf Origin "^http(s)?:\/\/(.+\.)?(iac-dev-ci\.shared\.sp\.domain\.com|bsi\.domain\.com)$...
0
votes
0answers
22 views

nginx not setting Vary header successfully

I have gzip_vary on; I also have (inside a server section): add_header Vary Origin; Yet when I inspect headers sent, the Vary header only includes Accept-Encoding; if I remove the gzip_vary on; ...
0
votes
0answers
54 views

How to define CORS settings on root level (base level) in Nginx configuration file

I have this working Nginx configuration: location /static/ { # Uncomment the following line in production mode expires max; # Remove signature of the static files that is used to ...
0
votes
0answers
85 views

Should I avoid CORS when building an SPA with backend API hosted on the same server?

I've stumbled upon this question and had the thought that my application should not require CORS, since it is hosted on the same server (a raspberry pi). However, since CORS is a security "feature" I'...
1
vote
1answer
336 views

Digital Ocean Spaces S3: Is it possible to add access-control-allow-origin: * to all requests?

If you curl my image curl -i https://local-spaces.fra1.digitaloceanspaces.com/test.jpg you will see that there is no Access-Control-Allow-Origin header in the response. If you curl like this, the ...
0
votes
1answer
469 views

Allow requests only for specific referer within domain

please consider following scenario: I have an API running on the same server as IIS. IIS is hosting a webpage. I want to allow access to the API to this webpage only. No other page from within the ...
0
votes
0answers
85 views

How to avoid or understand CORS-errors with Vuejs and Flask

I'm developing a full stack application using both Vuejs (Frontend) and Flask (Backend). Since I'm quite a newb I've looked into guides on how to make this work in general. Here's a few of the ...
0
votes
1answer
1k views

How to enable CORS in Nginx

I have tried every tutorial on the internet and on serverfault regarding this. No matter what I do, CORS is not working in nginx Here is my example.conf server { root /var/www/html; ...
1
vote
1answer
291 views

CloudFront drops Access-Control-Expose-Headers header when Accept-Encoding is set

I am trying to get CloudFront to serve a gzipped text file along with Content-Length: <bytes> and Access-Control-Expose-Headers: Content-Length headers so I can display the download progress ...
0
votes
1answer
804 views

CORS policy: No 'Access-Control-Allow-Origin' for JSON files

I kept a JSON files in Server A, ip : 111.111.111.111/folder1/a.json From Server B [ ip : 444.444.444.444 ], I am trying to access that JSON file , I received the result below: Access to ...
0
votes
1answer
1k views

VueJS sending POST to Flask fails (CORS Request blocked)

I've been following this vuejs guide and this flask guide to host my frontend and backend on a raspberry pi. On my frontend I have this method, which sends an axios POST to the backend. // path = ...
0
votes
1answer
177 views

Exchange REST API CORS Issue

I've created an add-in for Outlook which uses the Exchange REST API to load email headers and forward emails. In my O365 environment it works without any problem. Now I try to deploy the add-in at one ...
0
votes
0answers
66 views

CORS error when calling AutoMLClient() inside Cloud Fuction

Following this instruction: https://cloud.google.com/functions/docs/writing/http#functions_http_cors-python I can establish an cloud function to handle requests from different domains. However, when I ...
0
votes
0answers
85 views

Bypass Cross Origin Policy with IIS?

I have a Web map embedded in my HTML via IFrame. The problem is, that this map listens only to mouse events, touch events not working. So I would like to fix that by injecting additional js code to ...
1
vote
0answers
22 views

Path specific load-balancing over multiple AWS Beanstalk applications

I currently have two AWS beanstalk applications: One for my web app server (web_beanstalk_env) and one for my api (api_beanstalk_env). They are currently routed through Route 53 as api.example.com =&...
-2
votes
1answer
424 views

cors post laravel vuejs (405 Method Not Allowed)

People let me ask the same post method as to why the place is not. I'm calling api post between laravel and vuejs. thanks all read the article!
1
vote
0answers
309 views

CORS set to allow all but preflight still fails

I am using Istio in Google Kubernetes Engine with Istio. I've added a CORS policy to my virtual service that allows all origins. It looks like this: - match: - port: 443 route: - ...
0
votes
0answers
579 views

How get works symfony 4, cors, localhost, nginx

i have such nginx config: server { listen 127.0.0.1:80; server_name wtf; root /home/egor/PhpstormProjects/wtf/public/; client_max_body_size 32m; location / { if ($...
1
vote
1answer
411 views

Enable CORS for GKE Kubernetes API

I have a Kubernetes Engine cluster set up in Google Cloud Platform and it's working wonderfully. I can query the Kubernetes API itself to get info on Kubernetes objects, using the IP-based URL of the ...
0
votes
0answers
53 views

Nginx doesn't serve file when cors configured

I host an angular application on a nginx server. I need to configure cors as well, because I need ressources from a different domain. But when I configure my cors policy as shown below, my nginx ...
3
votes
0answers
1k views

.htaccess CORS headers not working

I've added the following at the top of my .htaccess file: <IfModule mod_headers.c> Header always set Access-Control-Allow-Origin "*" Header always set Access-Control-Allow-Headers "...
0
votes
0answers
741 views

Amazon S3 CORS - No 'Access-Control-Allow-Origin' header is present on the requested resource

I'm getting the following error when loading an asset via CloudFront Access to image at 'https://example.com/assets/image.png' from origin 'https://localhost:3000' has been blocked by CORS policy:...
0
votes
1answer
3k views

Multiple CORS origins. Should I use if statement? - NginX

I have set up an NginX in order to serve some static files from an instance. The static files are to be used by 3 different domains that I own. The NginX server is on its own (4th) domain. I want ...
1
vote
1answer
99 views

I want to add Apache Alias for api (Different users)

First of all i'm a beginner on these issues, sorry for this :) Actually i am a software developer. I have a project. Many domains connect to Rest Api domain. And all domains locate same server. I ...
0
votes
1answer
6k views

IIS10 Cors Module Configuration to Allow Cors

I'm having an issue allowing CORS requests on IIS v10 with an 2016 windows azure server. I downloaded and installed the IIS Cors module that is supposed to help take care of this, but I can't seem to ...
-1
votes
1answer
475 views

Aws s3 object acl everyone read access denied

I have upload one image but its not publicly accessible. I have granted full AWS s3 permission for the user. My canonical user id 9ebb86750cf9111e69a4c95e1c3c53062209080c56399ddc7919be48897cf25f. Same ...
2
votes
1answer
1k views

Cannot set CORSEnabled and CORSTrustedOrigins properties on ADFS 2019

The Problem: There are properties in ADFS 2019 that indicate that you can enable CORS Headers for the ADFS Login Page and set the allowed origins. Get-AdfsProperties CORSEnabled ...
0
votes
1answer
450 views

How to config nginx to include headers into response?

I have nginx which proxies requests to app server browser <=> nginx <=> app_server. For some reason not all headers provided by app_server will be returned to the browser. I.e. headers ...
3
votes
0answers
951 views

Nginx, PM2, Node - No 'Access-Control-Allow- Origin' header

I have developed NodeJS server ran with express. I use PM2 to manage the application and then nginx to proxy requests to the application. My Express application has CORS, CSP etc set up. But, the ...
0
votes
2answers
6k views

Did I implement CORS at the wrong place?

I have problem concerning CORS. I always get rejected from a clients api (Console error at the end of article). Now I'm wondering if its my fault at all. I hope to find the gap with your help. I got ...
0
votes
1answer
4k views

No 'Access-Control-Allow-Origin' header is present on the requested resource — But it is?

My /etc/apache2/sites-enabled/example.com.conf on a remote server looks like this... <VirtualHost *:80> ServerAdmin admin@example.com ServerName example.com ServerAlias ...
0
votes
1answer
1k views

Response from Cloudfront from S3 Origin keeps changing CORS Headers [duplicate]

here is my problem : CORS are set as supposed to be on the S3 : <CORSConfiguration> <CORSRule> <AllowedOrigin>*</AllowedOrigin> <AllowedMethod>GET</...
0
votes
2answers
3k views

Still get data even there is a CORS issue in Nginx

I'm trying to debug a CORS issue. Here's my configuration I'm using http://www.test-cors.org/ to test my Nginx rules. I get the message below in my browser's console when the method I use is OPTIONS. ...
3
votes
1answer
19k views

Nginx add headers and proxy_pass for CORS bypass

I want to make CORS site with API on proxy_pass server. But location / { if ($request_method = 'OPTIONS') { add_header 'Access-Control-Allow-Origin' '*'; add_header 'Access-...
1
vote
0answers
534 views

How can I set Access-Control-Allow-Origin for multiple domains in apache2?

I have created an app in React with its backend in Python Django. I hosted the React app in Heroku and the Django app in AWS (apache2). I have faced a problem with CORS. I added the following ...
0
votes
0answers
986 views

Cloudflare scrubbing Access-Control-Allow-Origin header when in Under Attack Mode

I need to be able to set the Access-Control-Allow-Origin response header with my server, however when I switch to Under Attack Mode (which I need right now because I'm being DDOSed), Cloudflare scrubs ...
0
votes
1answer
7k views

Enable CORS in Tomcat

SCENARIO: Frontend: Angular application living in NGINX Backend: java application living in Tomcat 8.5 The frontend needs to call backend Rest API. As far as I understand I need to allow CORS for ...
3
votes
1answer
821 views

Disable authorisation on preflight OPTIONS request in HAProxy

We have a HAProxy setup which has basic auth on some of our backends. We now want to enable CORS requests to our backends but this is failing for those with basic auth enabled. When CORS makes it ...
2
votes
0answers
507 views

CORS not works on Nginx

I need my application work with backend API on other domain. I use nginx 1.12.1 on Ubuntu 16.04. I added to my host config following (to the location ~ .php$ section): add_header 'Access-Control-...
0
votes
2answers
966 views

webDAV and CORS

I see some strange behavior on my webServer. Trying to get keeWeb to accept a file from a webDAV share on a different server. If I want to add a WebDAV File which is entered in Form of: https://FQDN:...
36
votes
2answers
25k views

Chrome S3 Cloudfront: No 'Access-Control-Allow-Origin' header on initial XHR request

I have a webpage (https://smartystreets.com/contact) that uses jQuery to load some SVG files from S3 through the CloudFront CDN. In Chrome I will open an Incognito window as well as the console. Then ...
1
vote
0answers
463 views

best practice for Single-Page Applications to access API's to avoid CORS across domains

here is the setup: having a onpage app living on example.com which should access the API on the domain api.example.com via AJAX. due to the CORS restriction i cannot access the API directly with ...