CORS issues from the browser from same origin?
Unanswered
Spectacled bear posted this in #help-forum
Spectacled bearOP
Hi all, I am having some CORs trouble.
Cross-origin redirection to https://www.MY-APP.com/api/games/playlists?gameId=228520 denied by Cross-Origin Resource Sharing policy: Origin https://www.MY-APP.com is not allowed by Access-Control-Allow-Origin. Status code: 308
I have setup cors as per the guide on the vercel website
https://vercel.com/guides/how-to-enable-cors
And I can see when checking the endpoint the correct headers are there.
Not really sure how to approach this, I assume my fetch request is missing some headers?
I have included an Accept: "application/json" header in the request but no luck.
Cross-origin redirection to https://www.MY-APP.com/api/games/playlists?gameId=228520 denied by Cross-Origin Resource Sharing policy: Origin https://www.MY-APP.com is not allowed by Access-Control-Allow-Origin. Status code: 308
I have setup cors as per the guide on the vercel website
https://vercel.com/guides/how-to-enable-cors
And I can see when checking the endpoint the correct headers are there.
Not really sure how to approach this, I assume my fetch request is missing some headers?
I have included an Accept: "application/json" header in the request but no luck.
9 Replies
can u share curl log?
curl -v -I https://your-vercel-server/api/accessible-by-www-myapp-comSpectacled bearOP
Sure:
my hunch is
access-control-allow-origin: *
is too open
so modify like this:
access-control-allow-origin: *
is too open
so modify like this:
res.setHeader('Access-Control-Allow-Origin', 'https://www.my-app.com')then try
curl -v -I https://your-vercel-server/api/accessible-by-www-myapp-com -H 'Origin: https://www.my-app.com'make sure it returns
access-control-allow-origin: https://www.my-app.comSpectacled bearOP
Yep, the change is fine but the problem persists. Any request from outside the browser shows the headers are there on the response, but when i inspect the failing requests from the network tab, they don't look like they are there
Regardless, it is very strange since the request is not cross origin at all anyway. both domains are the same
sorry? can u share the client js code that fetches https://www.MYAPP.xyz/api/games/playlists