Sign in

POSTMAN WORKS, THE BROWSER SAYS NO. CORS VS OUR OWN EXPRESS BACKEND

apicorsjavascript5 replies · 191 views · started
Reply
  1. Ruben
    @patchgarage

    ok so day two of fighting CORS. a browser extension popup calls our own Express backend, and every request dies with a CORS error.

    i've tried adding headers to my fetch call, setting mode to no-cors, and installing a browser extension that disables CORS. The extension works but obviously i can't ask users to install it. What's the actual correct setup here? i'd really like to understand the prpoer way instead of hacking around it. any ideas??

    15
  2. Diego Ekström
    @diego_tensor

    For your own Express backend, use the cors middleware before your routes: app.use(cors({ origin: 'https://your-site.example', credentials: true })). Make suree error responses (401, 500) also go through it; otherwise a real server error shows up in the browser as a misleading CORS error.

    0 4 helpful
  3. Diego Ekström
    @diego_tensor
    in reply to @diego_tensor

    ok so if you send cookies or use credentials: 'include', the server cannot use *. it must echo the exact origin and send Access-Control-Allow-Credentials: true. Thats why a wildcard sometimes doesnt work.

    5 0 helpful
  4. Chen A.
    @chen.arslan

    dumb question but how do i even check the cable, same issue here on my laptop, no idea whats going on

    0 1 helpful
  5. Arjun Nakamura
    @arjun.nakamura

    nah tbh I'd be careful with blanket backend proxies. if you forward everything without validation, you've built an open relay to someone else's API. restrict what teh proxy allows.

    2 0 helpful
  6. Ruben
    @patchgarage
    in reply to @diego_tensor

    @diego_tensor Set the explicit origin plus Allow-Credentials instead of the wildcard. Works in production now. Cant believe it was one header. cant believe it was that simple lol

    0 2 helpful

Reply to this topic

Sign in or create an account to reply.