# Allow cross origin requests only for message bus

**URL:** <https://meta.discourse.org/t/allow-cross-origin-requests-only-for-message-bus/266324>\
**Category:** Development\
**Created:** [May 26, 2023, 2:45pm UTC](https://meta.discourse.org/t/allow-cross-origin-requests-only-for-message-bus/266324 "2023-05-26T14:45:40Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![AhmedLoud](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ahmedloud/32/576547_2.png) [@AhmedLoud](https://meta.discourse.org/u/AhmedLoud)\
**Post date:** [May 30, 2023, 11:39am UTC](https://meta.discourse.org/t/allow-cross-origin-requests-only-for-message-bus/266324/4 "2023-05-30T11:39:03Z")

</div>

I forgot to mention but this is the first thing I tried and it didn’t work. But that was before I found out about the Access-Control-Allow-Headers. Maybe it will work if I add them like this.

```ruby

MessageBus.extra_response_headers_lookup do |env|
 [
    ["Access-Control-Allow-Origin", "http://example.com:3000"],
    ["Access-Control-Allow-Headers", env[HTTP_ACCESS_CONTROL_REQUEST_HEADERS]]
  ]
end

```

I will try again this way instead of the custom middleware and update this thread.

---

_[View the full topic](https://meta.discourse.org/t/allow-cross-origin-requests-only-for-message-bus/266324)._