# Adding HTTP Headers to Plugin in Development

**URL:** <https://meta.discourse.org/t/adding-http-headers-to-plugin-in-development/151789>\
**Category:** Development\
**Created:** [May 18, 2020, 5:33am UTC](https://meta.discourse.org/t/adding-http-headers-to-plugin-in-development/151789 "2020-05-18T05:33:48Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![DBHacker](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dbhacker/32/173072_2.png) [@DBHacker](https://meta.discourse.org/u/DBHacker)\
**Post date:** [May 18, 2020, 6:02am UTC](https://meta.discourse.org/t/adding-http-headers-to-plugin-in-development/151789/4 "2020-05-18T06:02:24Z")

</div>

> [@sam](#):
>
> ```plaintext
> if env['REQUEST_METHOD'] == ('OPTIONS') && env['HTTP_ACCESS_CONTROL_REQUEST_METHOD']
> return [200, Discourse::Cors.apply_headers(cors_origins, env, {}), []]
> end
> 
> ```

Maybe I need to set up this ENV?

```plaintext
  if env['REQUEST_METHOD'] == ('OPTIONS') && env['HTTP_ACCESS_CONTROL_REQUEST_METHOD']
    return [200, Discourse::Cors.apply_headers(cors_origins, env, {}), []]
  end

```

Do I need to set some ENV vars? If so, where? Maybe this is my failure?

Thanks!

FWIW, set this in the plugin initializer:

```plaintext
Discourse.SiteSettings.discourse_enable_cors = true;
Discourse.SiteSettings.discourse_cors_origin = "*";

```

and `console.log` shows these setting are OK… but the dreaded access denied remain in the console as well ☹

---

_[View the full topic](https://meta.discourse.org/t/adding-http-headers-to-plugin-in-development/151789)._