cors policy block

[flat pilot]

I have disabled cors on chrome and my function is accessible on my frontend but not working unless i disable cors. I have added the domain to platform and not fixed. Any help on this will be appreciated.

[thorn pasture]

What do you mean by disabling cors?

What's the fill error you're getting?

[flat pilot]

Disabling my chromes cors By doing that, Google Chrome will not send CORS preflight requests and will not validate CORS headers.

[thorn pasture]

Ok. How're you accessing the function?

[flat pilot]

Via http request

[thorn pasture]

But by calling the function domain or through appwrite API?

[flat pilot]

By calling function domain

[thorn pasture]

Ok. Do you have set your frontend and function domain in the appwrite settings?

[flat pilot]

Yes, I have tried by adding both , I even used wildcard

[thorn pasture]

Could you send the full error or errors?

[flat pilot]

Okay

Access to fetch at 'http://aa84263eed579ef.mydomain.com/top-users?criteria=alltime' from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

[thorn pasture]

Do you get any other errors apart from this one?

[flat pilot]

No

[flat pilot]

Even when I use Sdk i get the same error

[thorn pasture]

Then that means the problem is inside the function I think

What's it's code?

[flat pilot]

Iam using database only, my app do not require logging, incase this is the case

[flat pilot]

https://codefile.io/f/SjOX0Q3r3T

[jade pike]

see https://discord.com/channels/564160730845151244/1258561762358464562

[flat pilot]

I have sawn it, this hasn’t fixed my problem.

[jade pike]

Looking at your code, it doesn't seem like you did what was suggested in the thread

[flat pilot]

Really 😢 what was that

[flat pilot]

Please help me🙏

[jade pike]

Like Binyamin said:

You'll need to add the CORS yourself
For example allow all

return res.json(response,200,{'Access-Control-Allow-Origin': '*',})

[flat pilot]

I have added that. but yet not fixed. When i search the endpoint it normally prints the response but in my code not working. https://codefile.io/f/SjOX0Q3r3T

[flat pilot]

This is the new code

[flat pilot]

My appwrite is self hosted

[jade pike]

What's "in your code"? Your JavaScript app? What are the network logs there?

[flat pilot]

Yeah iam using reactjs

[flat pilot]

This is how Iam excuting using sdk https://codefile.io/f/pll2idbwYS

This is http request to the endpoint https://codefile.io/f/pn7QRI2YbF

[jade pike]

It also looks like you're using an API key client side. You should not be doing that because it exposes your API key

[jade pike]

So your executions are working fine, right? It's the get execution that's throwing an exception?

[jade pike]

What exactly do you mean by "it's not working"?

[flat pilot]

Okay🙏

[flat pilot]

Not working

[flat pilot]

Cors error

[flat pilot]

Access to fetch at 'http://aa84263eed579ef.mydomain.com/top-users?criteria=alltime' from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

[jade pike]

Should you be using https?

What are the network logs from your browser dev tools?

[flat pilot]

Iam using http

how shall I send you the log?

Request Method:
OPTIONS
Status Code:
204 No Content

Referrer Policy:
strict-origin-when-cross-origin
Access-Control-Allow-Headers:
Content-Type, Authorization, X-Requested-With
Access-Control-Allow-Methods:
GET, POST, OPTIONS
Access-Control-Allow-Origin:
*
Content-Type:
application/json; charset=utf-8
Date:
Sun, 21 Jul 2024 08:11:27 GMT
Server:
swoole-http-server
X-Debug-Speed:
0.033813953399658
Accept:
/
Accept-Encoding:
gzip, deflate
Accept-Language:
en-US,en;q=0.9
Access-Control-Request-Headers:
content-type,x-asbek-key,x-asbek-project
Access-Control-Request-Method:
GET
Connection:
keep-alive

Referrer Policy:
strict-origin-when-cross-origin
Content-Type:
application/json
Referer:
http://localhost:3000/
User-Agent:

[jade pike]

Screenshot showing the responses and the response headers of the options request

[flat pilot]

I just deleted the function and re created new one and the problem I was having have solved but, when I request https domain Iam getting insecure CMLHttp request endpoint, content must be served over https

[flat pilot]

Is there way appwrite hive certificate for the function domain? It’s self hosted

[flat pilot]

on doc it says "Appwrite generates TLS certificates to enforce HTTPS on all Appwrite Functions domains, generated or custom. These domains are safe to use and access in production."

[jade pike]

Where does it say that? I think we need to update it.

Appwrite doesn't generate certificates for the auto-generated function domains. See #1261339075118370969 message

[flat pilot]

https://appwrite.io/docs/products/functions/domains

[flat pilot]

can we docker compose exec appwrite ssl domain="auto generated function domain" ?

[jade pike]

Sure, but it's inefficient to have to run that for every new function

[flat pilot]

What if I have multiple functions? Ho do I add it in .env