I upgrade discourse yesterday and I get all the API callbacks with error I have found that the problem is the autentications headers (1) but I trying with some calls and I get this error: Access to XMLHttpRequest at 'https://mydomain.com/notifications.json?username=admin' from origin 'https://mydomain.com' has been blocked by CORS policy: Request header field api-username is not allowed by Access-Control-Allow-Headers in preflight response. I using Vue and I have added the api-key and api-username to the heades like this: Vue.http .get( "https://discourse.mydomain.com/notifications.json?username="+input.username, { headers: { "Api-Key":"xxxxxxxxxxxxxxxxx", "Api-Username": "system", "content-type": "application/json", accept: "application/json" } } ) (1) Discourse REST API Documentation

You may need to have CORS setup in your site settings?

Yes, I have added the domain where I call the API in discourse settings, but that error about field api-username, I dont know when I have to resolve.

[תמונה] pablogg: I using Vue "Api-Key":"xxxxxxxxxxxxxxxxx", "Api-Username": "system", You are putting your system API key in client side code? :scream: This means that anyone can grab it from your Javascript code and use it to completely own your forum. Any Ajax HTTP requests to Discourse should be leveraging an existing session, or not be needing a session at all.

Not just a testing , I am using the username Vue.http .get( "https://discourse.mydomain.com/notifications.json?username="+input.username, { headers: { "Api-Key":"xxxxxxxxxxxxxxxxxxxxxx", "Api-Username": input.username } } ) But I getting the same error with de Cors and the field api-username

Let me repeat what I said: [תמונה] RGJ: Any Ajax HTTP requests to Discourse should be leveraging an existing session That means: no authentication headers. At all.

You really should not be using these API credentials for CORS requests which is why that header field is not allowed. [תמונה] CORS error accessing API from javascript application Development Oh, so you are trying to make this request from a client-side javascript application? That is not permitted for numerous reasons. For example, if you include an admin API key in the source code of your javascript app, any user could gain full admin access to your forum. Here is a previous topic on the subject. However we do allow the user-api headers in CORS: [תמונה] Request header field User-Api-Key is not allowed by Access-Control-Allow-Headers Bug I’m trying to post comments to my Discourse instance from another web application using user api keys. I managed to get the user key following the method described in your original topic and this other useful discussion. After getting the key, when I send it along with my requests as a value of the User-Api-Key header, I get the Request header field User-Api-Key is not allowed by Access-Control-Allow-Headers error. As I asked in my PR, I’m not sure if it’s enough to add the headers in the file…

I have read the User API keys specification … In my case I have SSO with a frontend app in javascript, Could I consuming the API without using the authorization UI for every user? I would like a way that a could use de api-username … is that possible? Regards

could you solve this? Thank you!

In the end, I went back to the previous version of Discourse so I didn’t have to change all the API integration

Acess-Control-Allow-Headers CORS Error with API after updating discourse

תמיכה

RGJ (Richard - Communiteq) 12 באפריל,‏ 2020,‏ 6:09pm 6

Let me repeat what I said:

That means: no authentication headers. At all.

נושא		תגובות	צפיות
CORS error accessing API from javascript application Development	11	4177	9 באפריל,‏ 2023
API CORS Headers Incorrect Product Support	10	3228	6 ביולי,‏ 2020
Having issue accessing the Discourse APIs from react app Development rest-api	6	1024	10 באפריל,‏ 2023
Getting an error while trying to fetch individual posts General	1	959	14 באפריל,‏ 2022
Issue with Api Development	1	999	16 באוגוסט,‏ 2022

Acess-Control-Allow-Headers CORS Error with API after updating discourse

נושאים קשורים