# Geen 'Access-Control-Allow-Origin' header aanwezig ondanks instellen DISCOURSE\_ENABLE\_CORS: true **URL:** https://meta.discourse.org/t/no-access-control-allow-origin-header-is-present-despite-setting-discourse-enable-cors-true/207398 **Category:** Support **Created:** [28 oktober 2021 om 13:44 UTC](https://meta.discourse.org/t/no-access-control-allow-origin-header-is-present-despite-setting-discourse-enable-cors-true/207398 "2021-10-28T13:44:00Z") **Posts on this page:** 8 **Page:** 1
### Author: ![xprmnts](https://avatars.discourse-cdn.com/v4/letter/x/4af34b/32.png) [@xprmnts](https://meta.discourse.org/u/xprmnts) #### Post date: [28 oktober 2021 om 13:44 UTC](https://meta.discourse.org/t/no-access-control-allow-origin-header-is-present-despite-setting-discourse-enable-cors-true/207398/1 "2021-10-28T13:44:01Z")
I added the following statements in our app.yml ```plaintext DISCOURSE_ENABLE_CORS: true DISCOURSE_CORS_ORIGIN: '*' ``` Temporarily set ‘\*’ to eliminate variables while testing. I have also attempted setting urls explicitly to no avail. However, despite the above, we still get > Blockquote No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Context: We have a unity based iOS client that interfaces with some discourse APIS and for testing we use WebGL. And we face this issue when testing on our browsers running WebGL specifically. I am also observing from postman tests that all requests have a ‘strict-origin-when-cross-origin’ Referrer-Policy in the response headers. Any help is appreciated. Thank you! ---
### Author: ![IAmGav](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/iamgav/32/235598_2.png) [@IAmGav](https://meta.discourse.org/u/IAmGav) #### Post date: [28 oktober 2021 om 13:49 UTC](https://meta.discourse.org/t/no-access-control-allow-origin-header-is-present-despite-setting-discourse-enable-cors-true/207398/2 "2021-10-28T13:49:16Z")
`cors origins` setting is controlled in `admin > settings > security` you only need `DISCOURSE_ENABLE_CORS:` in your app.yml ---
### Author: ![xprmnts](https://avatars.discourse-cdn.com/v4/letter/x/4af34b/32.png) [@xprmnts](https://meta.discourse.org/u/xprmnts) #### Post date: [28 oktober 2021 om 13:53 UTC](https://meta.discourse.org/t/no-access-control-allow-origin-header-is-present-despite-setting-discourse-enable-cors-true/207398/3 "2021-10-28T13:53:21Z")
I attempted and tested this as well ![image](https://global.discourse-cdn.com/meta/original/3X/5/5/55c086ab5be238304c59cfde35520e2313563c0a.png) ---
### Author: ![xprmnts](https://avatars.discourse-cdn.com/v4/letter/x/4af34b/32.png) [@xprmnts](https://meta.discourse.org/u/xprmnts) #### Post date: [28 oktober 2021 om 13:58 UTC](https://meta.discourse.org/t/no-access-control-allow-origin-header-is-present-despite-setting-discourse-enable-cors-true/207398/4 "2021-10-28T13:58:38Z")
And for our single site setup setting origin in .yml vs. the admin ui should have the same effect per: [What is the purpose of Settings -\> Security -\> CORS origins vs similar environment setting?](https://meta.discourse.org/t/what-is-the-purpose-of-settings-security-cors-origins-vs-similar-environment-setting/35331) ---
### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco) #### Post date: [28 oktober 2021 om 14:12 UTC](https://meta.discourse.org/t/no-access-control-allow-origin-header-is-present-despite-setting-discourse-enable-cors-true/207398/5 "2021-10-28T14:12:35Z")
I’m not sure we support the wildcard here. Can you try it with a real domain? We are using the cors settings in a couple sites with domains configured and it appears to work fine. ---
### Author: ![IAmGav](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/iamgav/32/235598_2.png) [@IAmGav](https://meta.discourse.org/u/IAmGav) #### Post date: [28 oktober 2021 om 14:30 UTC](https://meta.discourse.org/t/no-access-control-allow-origin-header-is-present-despite-setting-discourse-enable-cors-true/207398/6 "2021-10-28T14:30:14Z")
i also have it set on one of my sites and it does work ---
### Author: ![xprmnts](https://avatars.discourse-cdn.com/v4/letter/x/4af34b/32.png) [@xprmnts](https://meta.discourse.org/u/xprmnts) #### Post date: [28 oktober 2021 om 14:51 UTC](https://meta.discourse.org/t/no-access-control-allow-origin-header-is-present-despite-setting-discourse-enable-cors-true/207398/7 "2021-10-28T14:51:26Z")
I attempted with a domain, no luck. Is there a way to confirm that the env vars are set correctly? (or that the app restart configured the cors without resending requests, just trying to think of ways to debug). I think this is the part of code that handles the cors settings, just in case it is useful. > ![image](https://global.discourse-cdn.com/meta/original/3X/8/c/8cceccdb4533380743ff54f45bb9bc56cdbef8eb.jpeg) ---
### Author: ![xprmnts](https://avatars.discourse-cdn.com/v4/letter/x/4af34b/32.png) [@xprmnts](https://meta.discourse.org/u/xprmnts) #### Post date: [28 oktober 2021 om 16:07 UTC](https://meta.discourse.org/t/no-access-control-allow-origin-header-is-present-despite-setting-discourse-enable-cors-true/207398/8 "2021-10-28T16:07:16Z")
![image](https://global.discourse-cdn.com/meta/original/3X/c/d/cd36735f582c0e8d2ce29031593ec40d62c432f4.png) Within the ngnix access logs I notice that the OPTIONS call returns a 404 (and precedes the error on the GET call)