A user, davide.porrovecchio, encountered an error when trying to use a User API key to post comments from another web application, receiving the message “Request header field User-Api-Key is not allowed by Access-Control-Allow-Headers.” They submitted a PR to add User-Api-Key and User-Api-Client-Id to the Access-Control-Allow-Headers header. After discussion with sam about the implementation, it was determined that the headers should be added to the discourse/config/initializers/008-rack-cors.rb file for comment posting. davide.porrovecchio updated the PR accordingly, and sam merged the changes.
I get this error message when trying to use User API key as described in User API keys specification.
I think User-Api-Key and User-Api-Client-Id should be added to Access-Control-Allow-Headers header as defined in discourse/config/initializers/004-message_bus.rb at main · discourse/discourse · GitHub.
Here is a PR that fixes this little bug.
Hmm @sam would need to peek at this.
Hmmm, can you explain how you are consuming the user API, I am not against adding this, just would like some clarification here.
I’m trying to post comments to my Discourse instance from another web application using user api keys. I managed to get the user key following the method described in your original topic and this other useful discussion.
After getting the key, when I send it along with my requests as a value of the User-Api-Key header, I get the Request header field User-Api-Key is not allowed by Access-Control-Allow-Headers error.
As I asked in my PR, I’m not sure if it’s enough to add the headers in the file config/initializers/004-message_bus.rb or we need to add them also in the file discourse/config/initializers/008-rack-cors.rb.
For comment posting it would be rack cors, message bus would only impact subscribing to the bus.
Ok, thank you for your explanation. I updated my PR accordingly.
This is now merged in, thanks!
This topic was automatically closed after 29 hours. New replies are no longer allowed.