A user, mymario, is trying to embed the latest updates from their Discourse installation (https://community.schulminator.com/) on their website (https://www.schulminator.com/). Despite setting up CORS origins in the admin panel and updating app.yml, they encounter a CORS policy error.
mymario shares their configuration and error message, which indicates the absence of the ‘Access-Control-Allow-Origin’ header. barreeeiroo reports experiencing the same issue.
johanricher suggests that a trailing slash in the CORS origin link might be the cause of the problem. They propose a change to the CORS setting documentation to make this clearer.
codinghorror suggests that the code should auto-remove trailing slashes. sam requests that vinothkannans implement this change, which is now fixed in a PR (#10996).
I even updated app.yml with the following lines and rebuild the whole thing: DISCOURSE_ENABLE_CORS: true DISCOURSE_CORS_ORIGIN: ‘https://www.schulminator.com/’
I don’t know if this is needed but it does work with this setting or without.
If anyone has a similar problem with a CORS configuration, please check that you removed the trailing slash from your link. A stupid mistake that cost me a couple of hours of my time.
I think the CORS setting tip should definitely be made clearer:
Current Text
Allowed origins for cross-origin requests (CORS). Each origin must include http:// or https://. The DISCOURSE_ENABLE_CORS env variable must be set to true to enable CORS.
Draft Proposition
Allowed origins for cross-origin requests (CORS). Each origin must include http:// or https:// and no trailing slash. The DISCOURSE_ENABLE_CORS env variable must be set to true to enable CORS.
Btw, how would one make a PR for something like this? Should it change only the English locale here and the translations will be managed elsewhere (e.g. through Transifex), or should the translations be also covered by the PR?
