I added the following statements in our app.yml DISCOURSE_ENABLE_CORS: true DISCOURSE_CORS_ORIGIN: '*' Temporarily set ‘*’ to eliminate variables while testing. I have also attempted setting urls explicitly to no avail. However, despite the above, we still get Blockquote No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Context: We have a unity based iOS client that interfaces with some discourse APIS and for testing we use WebGL. And we face this issue when testing on our browsers running WebGL specifically. I am also observing from postman tests that all requests have a ‘strict-origin-when-cross-origin’ Referrer-Policy in the response headers. Any help is appreciated. Thank you!

cors origins setting is controlled in admin > settings > security you only need DISCOURSE_ENABLE_CORS: in your app.yml

I attempted and tested this as well [image]

And for our single site setup setting origin in .yml vs. the admin ui should have the same effect per: What is the purpose of Settings -> Security -> CORS origins vs similar environment setting?

I’m not sure we support the wildcard here. Can you try it with a real domain? We are using the cors settings in a couple sites with domains configured and it appears to work fine.

i also have it set on one of my sites and it does work

I attempted with a domain, no luck. Is there a way to confirm that the env vars are set correctly? (or that the app restart configured the cors without resending requests, just trying to think of ways to debug). I think this is the part of code that handles the cors settings, just in case it is useful. config/initializers/008-rack-cors.rb 862773ec8 def call(env) cors_origins = @global_origins || [] cors_origins += SiteSetting.cors_origins.split('|') if SiteSetting.cors_origins.present? cors_origins = cors_origins.presence if env['REQUEST_METHOD'] == ('OPTIONS') && env['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] return [200, Discourse::Cors.apply_headers(cors_origins, env, {}), []] end env[Discourse::Cors::ORIGINS_ENV] = cors_origins if cors_origins status, headers, body = @app.call(env) headers ||= {} Discourse::Cors.apply_headers(cors_origins, env, headers) if cors_origins [status, headers, body] end This file has been truncated. show original [image]

[image] Within the ngnix access logs I notice that the OPTIONS call returns a 404 (and precedes the error on the GET call)

No 'Access-Control-Allow-Origin' header is present despite setting DISCOURSE_ENABLE_CORS: true

Product Support

xprmnts October 28, 2021, 1:53pm 3

I attempted and tested this as well

Topic		Replies	Views
What is the purpose of Settings -> Security -> CORS origins vs similar environment setting? Product Support	2	3774	November 9, 2015
CORS origins setup does not work Product Support	6	2142	October 22, 2020
Set DISCOURSE_ENABLE_CORS for hosted forum Self-hosting hosting	5	2640	October 7, 2022
Multiple cors origins on hosted discourse? Product Support	8	3241	August 21, 2017
CORS issue with javascript frontend Self-hosting	1	743	July 20, 2020

No 'Access-Control-Allow-Origin' header is present despite setting DISCOURSE_ENABLE_CORS: true

Related topics