# CORS 来源设置不生效
**URL:** https://meta.discourse.org/t/cors-origins-setup-does-not-work/105980
**Category:** Support
**Created:** [2019年一月8日 14:38 UTC](https://meta.discourse.org/t/cors-origins-setup-does-not-work/105980 "2019-01-08T14:38:11Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@mymario](https://meta.discourse.org/u/mymario)
#### Post date: [2019年一月8日 14:38 UTC](https://meta.discourse.org/t/cors-origins-setup-does-not-work/105980/1 "2019-01-08T14:38:11Z")
I want to embed the latest updates from our community on my website:
- Website: [https://www.schulminator.com/](https://www.schulminator.com/)
- Discourse installation: [https://community.schulminator.com/](https://community.schulminator.com/)
To accomplish this, I am trying to access the **latest.json** and will parse that appropriately and embed on my site:
- [https://community.schulminator.com/latest.json](https://community.schulminator.com/latest.json)
I went to admin and setup the CORS origins:
I even updated app.yml with the following lines and rebuild the whole thing:
_DISCOURSE\_ENABLE\_CORS: true_
_DISCOURSE\_CORS\_ORIGIN: ‘[https://www.schulminator.com/](https://www.schulminator.com/)’_
I don’t know if this is needed but it does work with this setting or without.
But still same issue as you check on this site:
[https://www.schulminator.com/test?123](https://www.schulminator.com/test?123)
_Access to XMLHttpRequest at ‘[https://community.schulminator.com/latest.json](https://community.schulminator.com/latest.json)’ from origin ‘[https://www.schulminator.com](https://www.schulminator.com)’ has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’ header is present on the requested resource._
I am really stuck here…
---
### Author:  [@barreeeiroo](https://meta.discourse.org/u/barreeeiroo)
#### Post date: [2019年十二月3日 19:54 UTC](https://meta.discourse.org/t/cors-origins-setup-does-not-work/105980/2 "2019-12-03T19:54:04Z")
我这里也有同样的问题
有人成功解决了吗？
---
### Author:  [@johanricher](https://meta.discourse.org/u/johanricher)
#### Post date: [2020年十月14日 10:13 UTC](https://meta.discourse.org/t/cors-origins-setup-does-not-work/105980/3 "2020-10-14T10:13:27Z")
如果任何人遇到类似的 CORS 配置问题，请检查是否已移除链接末尾的斜杠。这是一个愚蠢的错误，却浪费了我几个小时的时间。😅
---
### Author:  [@johanricher](https://meta.discourse.org/u/johanricher)
#### Post date: [2020年十月19日 17:32 UTC](https://meta.discourse.org/t/cors-origins-setup-does-not-work/105980/4 "2020-10-19T17:32:10Z")
我认为 CORS 设置提示确实应该更加明确：
当前文本
> 跨域请求（CORS）允许的源。每个源必须包含 http:// 或 https://。必须将 DISCOURSE\_ENABLE\_CORS 环境变量设置为 true 以启用 CORS。
草案提议
> 跨域请求（CORS）允许的源。每个源必须包含 http:// 或 https:// **且不得包含尾部斜杠** 。必须将 DISCOURSE\_ENABLE\_CORS 环境变量设置为 true 以启用 CORS。
顺便问一下，针对此类问题该如何提交 PR？是只需修改英文本地化文件 [此处](https://github.com/discourse/discourse/blob/master/config/locales/server.en.yml#L1555)，而翻译工作由其他平台（例如 Transifex）管理，还是 PR 中也需要包含翻译内容？
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2020年十月22日 02:02 UTC](https://meta.discourse.org/t/cors-origins-setup-does-not-work/105980/5 "2020-10-22T02:02:14Z")
如果末尾斜杠是个问题，我们的代码应该自动将其移除 @sam。
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2020年十月22日 04:43 UTC](https://meta.discourse.org/t/cors-origins-setup-does-not-work/105980/7 "2020-10-22T04:43:12Z")
@vinothkannans 能否修改一下，让这里自动去除末尾的斜杠？
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [2020年十月22日 07:57 UTC](https://meta.discourse.org/t/cors-origins-setup-does-not-work/105980/8 "2020-10-22T07:57:04Z")
此问题已在以下 PR 中修复：
>
>
> And also a validation is added for site setting.
>
> The CORS functionality is no…t working as expected if the trailing slash is not stripped.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2020年十月23日 00:44 UTC](https://meta.discourse.org/t/cors-origins-setup-does-not-work/105980/9 "2020-10-23T00:44:26Z")