# CORS issue with javascript frontend

**URL:** https://meta.discourse.org/t/cors-issue-with-javascript-frontend/158039
**Category:** Self-hosting
**Created:** [July 17, 2020, 1:55pm UTC](https://meta.discourse.org/t/cors-issue-with-javascript-frontend/158039 "2020-07-17T13:55:58Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![KGrzeg](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kgrzeg/32/157356_2.png) [@KGrzeg](https://meta.discourse.org/u/KGrzeg)
#### Post date: [July 17, 2020, 1:55pm UTC](https://meta.discourse.org/t/cors-issue-with-javascript-frontend/158039/1 "2020-07-17T13:55:58Z")

</div>

Hi!

I can’t figure out, how to setup properly CORS policy for my discourse forum.  
I have Discourse installed at [https://forum.bitbetter.club/](https://forum.bitbetter.club/) and try to get post from thread using JSON API, for example from this path [https://forum.bitbetter.club/t/weeks-25-and-26-prisoners-of-geography/128.json](https://forum.bitbetter.club/t/weeks-25-and-26-prisoners-of-geography/128.json)

I get error on frontend

> has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’

The frontend app is hosted at [https://books.bitbetter.club/](https://books.bitbetter.club/) using [netlify](https://www.netlify.com/) so deploy previews have different domain.

I tried to setup `cors origins` setting in Discourse, but that don’t look to make any change. (tried ceratin domain with protocol, without protocol, with full URI and every other possibility, and even `*`)

Is it possible that nginx blocks some http parameters? Where should I look next?

---

<div class="post-metadata">

### Author: ![KGrzeg](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kgrzeg/32/157356_2.png) [@KGrzeg](https://meta.discourse.org/u/KGrzeg)
#### Post date: [July 20, 2020, 10:31am UTC](https://meta.discourse.org/t/cors-issue-with-javascript-frontend/158039/2 "2020-07-20T10:31:02Z")

</div>

I figured it out myself. I was in bad belief, that CORS policy is turned ON by default.

I edited `app.yml` and added `DISCOURSE_ENABLE_CORS=true`, rebooted app and all works fine.

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [August 19, 2020, 10:31am UTC](https://meta.discourse.org/t/cors-issue-with-javascript-frontend/158039/3 "2020-08-19T10:31:02Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
