No 'Access-Control-Allow-Origin' header is present despite setting DISCOURSE_ENABLE_CORS: true

xprmnts · October 28, 2021, 1:44pm

I added the following statements in our app.yml

  DISCOURSE_ENABLE_CORS: true
  DISCOURSE_CORS_ORIGIN: '*'

Temporarily set ‘*’ to eliminate variables while testing. I have also attempted setting urls explicitly to no avail.

However, despite the above, we still get

Blockquote

No ‘Access-Control-Allow-Origin’ header is present on the requested resource.

Context: We have a unity based iOS client that interfaces with some discourse APIS and for testing we use WebGL. And we face this issue when testing on our browsers running WebGL specifically.

I am also observing from postman tests that all requests have a ‘strict-origin-when-cross-origin’ Referrer-Policy in the response headers.

Any help is appreciated. Thank you!

IAmGav · October 28, 2021, 1:49pm

cors origins setting is controlled in admin > settings > security

you only need DISCOURSE_ENABLE_CORS: in your app.yml

xprmnts · October 28, 2021, 1:53pm

I attempted and tested this as well

xprmnts · October 28, 2021, 1:58pm

And for our single site setup setting origin in .yml vs. the admin ui should have the same effect per: What is the purpose of Settings -> Security -> CORS origins vs similar environment setting?

Falco · October 28, 2021, 2:12pm

I’m not sure we support the wildcard here. Can you try it with a real domain? We are using the cors settings in a couple sites with domains configured and it appears to work fine.

IAmGav · October 28, 2021, 2:30pm

i also have it set on one of my sites and it does work

xprmnts · October 28, 2021, 2:51pm

I attempted with a domain, no luck. Is there a way to confirm that the env vars are set correctly? (or that the app restart configured the cors without resending requests, just trying to think of ways to debug).

I think this is the part of code that handles the cors settings, just in case it is useful.

github.com

discourse/discourse/blob/862773ec83756a2deb6beaabbcb16756a98595f9/config/initializers/008-rack-cors.rb#L13-L49

    
      
          def call(env)
          
          
  cors_origins = @global_origins || []
            cors_origins += SiteSetting.cors_origins.split('|') if SiteSetting.cors_origins.present?
            cors_origins = cors_origins.presence
          
          
  if env['REQUEST_METHOD'] == ('OPTIONS') && env['HTTP_ACCESS_CONTROL_REQUEST_METHOD']
              return [200, Discourse::Cors.apply_headers(cors_origins, env, {}), []]
            end
          
          
  env[Discourse::Cors::ORIGINS_ENV] = cors_origins if cors_origins
          
          
  status, headers, body = @app.call(env)
            headers ||= {}
          
          
  Discourse::Cors.apply_headers(cors_origins, env, headers) if cors_origins
          
          
  [status, headers, body]
          end

This file has been truncated. show original

xprmnts · October 28, 2021, 4:07pm

Within the ngnix access logs I notice that the OPTIONS call returns a 404 (and precedes the error on the GET call)

Topic		Replies	Views
CORS policy configuration with React Support	3	1679	April 8, 2023
CORS error when trying to load custom font Dev	4	1332	April 28, 2020
Adding HTTP Headers to Plugin in Development Dev	3	841	May 18, 2020
DISCOURSE_ENABLE_CORS not impacting Nginx config Installation	3	1403	October 13, 2015
CORS issue on meta Site feedback	11	2652	August 25, 2015

No 'Access-Control-Allow-Origin' header is present despite setting DISCOURSE_ENABLE_CORS: true

Related topics