# CORS error accessing API from javascript application

**URL:** https://meta.discourse.org/t/cors-error-accessing-api-from-javascript-application/128785
**Category:** Development
**Created:** [September 17, 2019, 12:49pm UTC](https://meta.discourse.org/t/cors-error-accessing-api-from-javascript-application/128785 "2019-09-17T12:49:29Z")
**Posts on this page:** 1
**Showing post:** 6

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [September 17, 2019, 1:15pm UTC](https://meta.discourse.org/t/cors-error-accessing-api-from-javascript-application/128785/6 "2019-09-17T13:15:26Z")

</div>

Oh, so you are trying to make this request from a client-side javascript application? That is not permitted for numerous reasons. For example, if you include an admin API key in the source code of your javascript app, any user could gain full admin access to your forum. [Here is](https://meta.discourse.org/t/what-are-the-risks-of-enabling-cross-origin-resource-sharing-discourse-enable-cors/41248) a previous topic on the subject.

---

_[View the full topic](https://meta.discourse.org/t/cors-error-accessing-api-from-javascript-application/128785)._