Disable same origin policy in Chrome

Question

Is there any way to disable the Same-origin policy on Google's Chrome browser?

See also http://peter.sh/experiments/chromium-command-line-switches/, I am not sure of its authenticity but it appears to be a collection produced by an automated process — CSSian, Dec 18 '13 at 18:01
[chromium.org](http://www.chromium.org/developers/how-tos/run-chromium-with-flags) links to the `peter.sh` page, so must be pretty legit. — Benjineer, Jan 07 '15 at 13:21
Note that disabling SOP, even when only used for development, is dangerous. When you start your browser this way, you are probably not only going to open your app, but also check your mails, read SO… Considering using better alternatives, e.g. web proxies, to resolve these issues. For instance via proxrox: https://github.com/bripkens/proxrox — BenR, Dec 26 '15 at 07:39
Since version 49, use this option ```--disable-web-security --user-data-dir``` — vanduc1102, Mar 10 '16 at 01:37
For anyone looking for advice on how to do this in a developer environment using a grunt run server see this: https://gist.github.com/Vp3n/5340891 — GrayedFox, Apr 13 '16 at 16:07
I've wrote a small post about [chrome without cors](https://alfilatov.com/posts/run-chrome-without-cors/) — Alex Filatov, Nov 13 '18 at 22:39
If you just need to test a site without cors, use Safari, where you just need to turn on and off options, instead of launching another instance of the browser: [https://stackoverflow.com/a/12158217/922457] — Edenshaw, Sep 27 '19 at 20:25
If your intent is local development, set a Hosts file entry so your dev URL can be the same as the iframed URL and then set (with JavaScript) document.domain = [parent domain] for both parent and child documents. Then you won't have to figure this out again 2 years from now. Look at 'Changing origin' here https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy — Wes Grant, Mar 18 '20 at 21:47
If one is simply desiring to test disabling this (which I was doing), it's much easier done in [Safari](https://stackoverflow.com/questions/4556429/disabling-same-origin-policy-in-safari). — Mr Rogers, Jun 03 '20 at 17:42

score 1135 · Accepted Answer · edited Jun 05 '18 at 18:05

Close chrome (or chromium) and restart with the --disable-web-security argument. I just tested this and verified that I can access the contents of an iframe with src="http://google.com" embedded in a page served from "localhost" (tested under chromium 5 / ubuntu). For me the exact command was:

Note : Kill all chrome instances before running command

chromium-browser --disable-web-security --user-data-dir="[some directory here]"

The browser will warn you that "you are using an unsupported command line" when it first opens, which you can ignore.

From the chromium source:

// Don't enforce the same-origin policy. (Used by people testing their sites.)
const wchar_t kDisableWebSecurity[] = L"disable-web-security";

Before Chrome 48, you could just use:

chromium-browser --disable-web-security

Make sure the directory exists on Windows. Create one in your personal Users\[user]\ folder. — Dmitri R117, Nov 25 '20 at 07:46

score 1110 · Answer 2 · edited Jun 20 '20 at 09:12

1110

Yep. For OSX, open Terminal and run:

$ open -a Google\ Chrome --args --disable-web-security --user-data-dir

--user-data-dir required on Chrome 49+ on OSX

For Linux run:

$ google-chrome --disable-web-security

Also if you're trying to access local files for dev purposes like AJAX or JSON, you can use this flag too.

-–allow-file-access-from-files

For Windows go into the command prompt and go into the folder where Chrome.exe is and type

chrome.exe --disable-web-security

That should disable the same origin policy and allow you to access local files.

Update: For Chrome 22+ you will be presented with an error message that says:

You are using an unsupported command-line flag: --disable-web-security. Stability and security will suffer.

However you can just ignore that message while developing.

edited Jun 20 '20 at 09:12

Community

1
1

answered May 21 '11 at 18:36

ectype

13,787
5
18
28

4

I had to add a path after `--user-data-dir` as in `--user-data-dir="tmp"` for it to work (Chrome 88.0...) – Ryan H. Mar 10 '21 at 22:15
Chrome 89.0 - I also had to add `--user-data-dir="[PATH]"`, otherwise it won't work – Shimi Shimson Mar 27 '21 at 16:02
If you would like your existing user directory, on MacOS you may find it under: `--user-data-dir="/Users//Library/ApplicationSupport/Google/Chrome"`. Type `whoami` or `pwd -P` in terminal to find your username. – FooBar May 16 '21 at 16:01

Ola Karlsson · Answer 3 · 2021-04-29T08:51:25.467

For Windows users:

The problem with the solution accepted here, in my opinion is that if you already have Chrome open and try to run the chrome.exe --disable-web-security command it won't work.

However, when researching this, I came across a post on Super User, Is it possible to run Chrome with and without web security at the same time?.

Basically, you need to add to the command and run it like this instead (or create a shortcut with it and run a new Chrome instance through that)

chrome.exe --user-data-dir="C:/Chrome dev session" --disable-web-security

which will open a new "insecure" instance of Chrome at the same time as you keep your other "secure" browser instances open and working as normal.

This works by creating a new folder/directory "Chrome dev session" under C: and tells this new Chrome instance to use that folder/directory for its user and session data. Because of this, the new instance is separated from your "normal" Chrome data and your bookmarks and other saved data will not be available in this instance.

Note: only the first "new" instance of Chrome opened with this method, is effected, hence it is only the first tab in the first new Chrome window, which is effected. If you close that instance, you can use the same command again and for example any bookmarks to your local app or similar will still be there as it's pointing to the same folder.

If you want to run multiple "insecure" instances, each one will need its own folder/directory, so you will need to runt he command again with a different folder name. This however also means that each insecure instance will be separated from the others, so any bookmarks or other saves user or session data will not be available across instances.

Gauri Bhosle · Answer 4 · 2020-08-07T08:09:45.753

For Windows:

Open the start menu
Type windows+R or open "Run"

Execute the following command:

 chrome.exe --user-data-dir="C://Chrome dev session" --disable-web-security

For Mac:

Go to Terminal

Execute the following command:

 open /Applications/Google\ Chrome.app --args --user-data-dir="/var/tmp/Chrome dev session" --disable-web-security

A new web security disabled chrome browser should open with the following message:

For Mac

If you want to open new instance of web security disabled Chrome browser without closing existing tabs then use below command

open -na Google\ Chrome --args --user-data-dir=/tmp/temporary-chrome-profile-dir --disable-web-security

It will open new instance of web security disabled Chrome browser as shown below

Ognyan Dimitrov · Answer 5 · 2019-01-19T17:29:15.250

89

For windows users with Chrome Versions 60.0.3112.78 (the day the solution was tested and worked) and at least until today 19.01.2019 (ver. 71.0.3578.98). You do not need to close any chrome instance.

Create a shortcut on your desktop
Right-click on the shortcut and click Properties
Edit the Target property
Set it to "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --disable-web-security --user-data-dir="C:/ChromeDevSession"
Start chrome and ignore the message that says --disable-web-security is not supported!

BEWARE NOT TO USE THIS PARTICULAR BROWSER INSTANCE FOR BROWSING BECAUSE YOU CAN BE HACKED WITH IT!

edited Jan 19 '19 at 17:29

answered Aug 01 '17 at 09:27

Ognyan Dimitrov

5,392
1
40
64

Worked like a charm. I can't believe Chrome doesn't allow developers to disable this without starting a new session. At least they have a way though. – FearlessFuture Sep 15 '17 at 22:47
and can you still use chrome debugging on your source code? – Righto Sep 22 '17 at 08:19
just tested, you can still use dev tool under this mode. – KuN Jan 25 '18 at 21:03
This solution still works as of chrome version 71 Thanks so much! – Motoman Jan 18 '19 at 17:32
Works with 72.0.3626.109. Helped a lot! – Pavel Molchanov Feb 18 '19 at 21:10

Coburn · Answer 6 · 2019-11-23T07:54:05.637

78

EDIT 3: Seems that the extension no longer exists... Normally to get around CORS these days I set up another version of Chrome with a separate directory or I use Firefox with https://addons.mozilla.org/en-US/firefox/addon/cors-everywhere/ instead.

EDIT 2: I can no longer get this to work consistently.

EDIT: I tried using the just the other day for another project and it stopped working. Uninstalling and reinstalling the extension fixed it (to reset the defaults).

Original Answer:

I didn't want to restart Chrome and disable my web security (because I was browsing while developing) and stumbled onto this Chrome extension.

Chrome Web Store Allow-Control-Allow-Origin: *
(https://chrome.google.com/webstore/detail/allow-control-allow-origi/nlfbmbojpeacfghkpbjhddihlkkiljbi?hl=en)

Basically it's a little toggle switch to toggle on and off the Allow-Access-Origin-Control check. Works perfectly for me for what I'm doing.

edited Nov 23 '19 at 07:54

answered Jun 20 '14 at 06:03

Coburn

1,614
20
33

1

how I achieve and integrate with my extension as my extension needs to access cross domain. I cannot force user to open the browser wth disable-web-security – codebased Apr 14 '15 at 03:01
It only allows AJAX requests not normal webpages and extensions to access webpages. – Lothar May 08 '15 at 10:26
1

This extension won't work for local files, unfortunately. Stick to the `--disable-web-security` switch in that case. – bryc Jul 15 '15 at 02:25
2

@bryc It's not really meant to. Consider though that you can use `--allow-file-access-from-files` instead of disabling all web security. – Coburn Jul 15 '15 at 02:29
Extension is useful, works as expected. _BUT_ If I toggle on this extension then I can't browse youtube, google docs etc.. I'm sure problem in extension. – MyTitle Nov 30 '15 at 18:50
Yup, you are right, I am getting this same problem. The specific error in the Javascript console is this one (no idea if there's a work around) http://stackoverflow.com/questions/19743396/cors-cannot-use-wildcard-in-access-control-allow-origin-when-credentials-flag-i – Coburn Dec 05 '15 at 22:48
1

Warning! Some sites won't let you log in with this extension enabled! Firebase console, for example. – campsjos Mar 23 '17 at 13:08
1

“the extension no longer exists” can you delete your answer or at least put Edit 3 at the top in bold – Michael Freidgeim Nov 23 '19 at 00:17

user2576266 · Answer 7 · 2021-04-26T15:14:19.033

58

Using the current latest chrome version (90.0.4430.85 (Official Build) (64-bit)), the only way I could make it work on windows 10 was to start chrome using the below flags (change the D:\temp to your liking). This solution will start chrome as a sandbox for tests and it will not affect the main chrome profile:

--disable-site-isolation-trials --disable-web-security --user-data-dir="D:\temp"

in windows, click the start button then copy paste the below:

chrome.exe  --disable-site-isolation-trials --disable-web-security --user-data-dir="D:\temp"

edited Apr 26 '21 at 15:14

answered Mar 31 '19 at 14:53

user2576266

1,075
1
9
16

6

This is the only solution works for me. I have run this `chrome.exe --disable-site-isolation-trials --disable-web-security --user-data-dir="D:\temp"` on `run` window on windows 10. Thanks a lot. – Sampath Apr 07 '19 at 08:10
HAIR PULLING ARGHGHGH - doesn't seem to work anymore – Daniel Sokolowski May 09 '19 at 20:28
2

Adding --disable-site-isolation-trials really helped me in my case, Chrome v 75.0, Selenium Web Driver, Java. Thanks! – Nikolay Chernov Aug 24 '19 at 16:52
If you just need to test a site with cors, use Safari, where you just need to turn on and off options, instead of launching another instance of the browser or killing instances: [https://stackoverflow.com/a/12158217/922457 ] – Edenshaw Sep 27 '19 at 20:31
1

Worked for me on windows! Thankies! – Jánosi-Borsos Róbert Feb 04 '20 at 14:29
1

This is the only thing that worked in Chrome latest version as of July 2020. – Abraham Roy Jul 23 '20 at 07:10
i use exactly this version `87.0.4280.66` and this solution not works in linux, even installing cors extentions not works at all – a55 Jan 21 '21 at 22:19
2

It works for me on Linux, but with a little modification `google-chrome --disable-site-isolation-trials --disable-web-security --user-data-dir="/tmp"` – Serhii Popov Feb 25 '21 at 11:04
which version this will be changed? – eri Apr 12 '21 at 09:37

Jianwu Chen · Answer 8 · 2019-03-04T03:28:01.593

53

Seems none of above solutions are actually working. The --disable-web-security is no longer supported in recent chrome versions.

Allow-Control-Allow-Origin: * - chrome extension partially solved the problem. It works only if your request is using GET method and there's no custom HTTP Header. Otherwise, chrome will send OPTIONS HTTP request as a pre-flight request. If the server doesn't support CORS, it will respond with 404 HTTP status code. The plugin can't modify the response HTTP status code. So chrome will reject this request. There's no way for chrome plugin to modify the response HTTP status code based on current chrome extension API. And you can't do a redirect as well for XHR initiated request.

Not sure why Chrome makes developers life so difficult. It blocks all the possible ways to disable XSS security check even for development use which is totally unnecessary.

After days struggle and research, one solution works perfectly for me: to use corsproxy. You have two options here: 1. use [https://cors-anywhere.herokuapp.com/] 2. install corsproxy in the local box: npm install -g corsproxy

[Updated on Jun 23, 2018] Recent I'm developing an SPA app which need to use corsproxy again. But seem none of the corsproxy on the github can meet my requirement.

need it to run inside firewall for security reason. So I can't use https://cors-anywhere.herokuapp.com/.
It has to support https as chrome will block no-https ajax request in an https page.
I need to run on nodejs. I don't want to maintain another language stack.

So I decide to develop my own version of corsproxy with nodejs. It's actually very simple. I have published it as a gist on the github. Here is the source code gist: https://gist.github.com/jianwu/8e76eaec95d9b1300c59596fbfc21b10

It's in plain nodejs code without any additional dependencies
You can run in http and https mode (by passing the https port number in command line), to run https, you need to generate cert and key and put them in the webroot directory.
It also serves as static file server
It supports pre-flight OPTION request as well.

To start the CORSProxy server (http port 8080): node static_server.js 8080

to access the proxy: http://host:8080/http://www.somesite.com

edited Mar 04 '19 at 03:28

answered Jan 12 '15 at 07:51

Jianwu Chen

3,644
3
20
27

If you're going to go to that extent, you could always just host a web server locally or remotely that pulls the content from the webpage you desire and then set the proper CORS headers on that. – Coburn Mar 03 '15 at 20:51
I have thought of this route before. But this need some coding, especially in my case, I need to call several services which are originated from different domains. So I have to map different URL pattern to different domains. This is exactly what corsproxy has done for us. And it works perfectly. – Jianwu Chen Apr 22 '15 at 00:11
Of course doesn't work with https which is something google and mozilla want to enforce now on every page. – Lothar May 08 '15 at 10:28
4

Not true.. The way mentioned in accepted answer worked for me.. As it mentions, Chrome 49 onwards command 'chrome.exe --disable-web-security --user-data-dir' worked for me.. – Gaurang Patel May 24 '16 at 06:15
--disable-web-security is "unsupported" but continue to work just fine – guya Jun 27 '16 at 22:32
2

Chromium 53, --disable-web-security --user-data-dir didn't work for me – Dark Star1 Sep 29 '16 at 01:57
4

In 53+ you need to actual provide a unique user data directory which is different from your normal directory. This creates a new profile for the insecure environment. --user-data-dir needs to be set equal to something, such as in Olas answer above. If you really want to, you CAN set it equal to your actual normal user profile folder, but this is highly discouraged as it leaves your normal profile open to accidental attacks if you start normal browsing while in that mode. – lassombra Jan 10 '17 at 14:27
Can you provide an example on how to use this? What URL should I use after running the Node.js server? Is it similar to CORS-ANYWHERE? – wwjdm Feb 27 '19 at 15:30
@wwjdm, you are right, it's similar, you can specify the url in the following format http://host:8080/http://www.somesite.com, i have added it to the jsdoc in the gist. – Jianwu Chen Mar 04 '19 at 07:10
Unfortunately, `corsproxy` doesn't work anymore because of deprecated Node API. `TypeError: Os.tmpDir is not a function` – Eugene Karataev Jan 26 '21 at 10:59

score 48 · Answer 9 · edited Jan 24 '18 at 13:52

48

For Windows... create a Chrome shortcut on your desktop.
Right-click > properties > Shortcut
Edit "target" path :

"C:\Program Files\Google\Chrome\Application\chrome.exe" --args --disable-web-security

(Change the 'C:....\chrome.exe' to where ever your chrome is located).

et voilà :)

edited Jan 24 '18 at 13:52

Ronnie Oosting

1,196
1
11
32

answered Aug 27 '13 at 12:43

molokoloco

4,126
2
29
26

As of today 08/27/20013 it's works for me, allowing me to do Ajax on my own localhost. – molokoloco Aug 27 '13 at 12:45
got "you are using an unsupported command line tag: --disable-web-security" with Canary version 53 – khoailang Jun 28 '16 at 10:27
4

@khoailang you can still use the switch. That warning is part of Google's war on insecurity (a good thing). Also, as of version 55+ you need to also use --user-data-dir= so Google doesn't want you mixing insecure rules with your normal profiles. – lassombra Jan 10 '17 at 14:33

score 48 · Answer 10 · edited Jun 05 '18 at 14:49

48

Try this command on Mac terminal-

open -n -a "Google Chrome" --args --user-data-dir=/tmp/temp_chrome_user_data_dir http://localhost:8100/ --disable-web-security

It opens another instance of chrome with disabled security and there is no CORS issue anymore. Also, you don't need to close other chrome instances anymore. Change localhost URL to your's one.

edited Jun 05 '18 at 14:49

Manikandan C

592
7
15

answered Dec 26 '17 at 09:04

Vivek Sinha

1,398
1
12
23

Most of the command-line answers above made no improvement for me on macOS. However this post https://alfilatov.com/posts/run-chrome-without-cors/ and the command line open worked for me. It is the same as the command above so voting up. – Max MacLeod Feb 12 '20 at 12:00

etoxin · Answer 11 · 2016-09-27T07:52:06.193

46

I find the best way to do this is duplicate a Chrome or Chrome Canary shortcut on your windows desktop. Rename this shortcut to "NO CORS" then edit the properties of that shortcut.

in the target add --disable-web-security --user-data-dir="D:/Chrome" to the end of the target path.

your target should look something like this:

Update: New Flags added.

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --disable-web-security --user-data-dir="D:/Chrome"

edited Sep 27 '16 at 07:52

answered Jan 13 '16 at 23:48

etoxin

3,828
2
31
45

This just gives me 404 now instead of pre-flight error – L1ghtk3ira Aug 23 '16 at 16:19
A 404 error would be a server related error and not a Google Chrome error. – etoxin Aug 24 '16 at 02:13
2

@etoxin This answer is no longer valid in the latest version of chrome. You have to add --disable-web-security --user-data-dir="D:/Chrome" – Vignesh S Sep 24 '16 at 13:00

score 22 · Answer 12 · edited Oct 23 '20 at 16:56

22

Don't do this! You're opening your accounts to attacks. Once you do this any 3rd party site can start issuing requests to other websites, sites that you are logged into.

Instead run a local server. It's as easy as opening a shell/terminal/commandline and typing

cd path/to/files
python -m SimpleHTTPServer

Then pointing your browser to

http://localhost:8000

If you find it's too slow consider this solution

Update

People downvoting this answer should go over here and downvote this one too to be consistent. No idea why my answer is so downvoted and the same answer over here is the top voted answer.

You are opening yourself to attacks. Every single 3rd party script you include on your site remotely or locally like via npm can now upload your data or steal your credentials. You are doing something you have no need to do. The suggested solution is not hard, takes 30 seconds, doesn't leave you open attack. Why would you choose to make yourself vulnerable when the better thing to do is so simple?

Telling people to disable security is like telling your friends to leave their front door unlocked and/or a key under the doormat. Sure the odds might be low but if they do get burgled, without proof of forced entry they might have a hard time collecting insurance. Similarly if you disable security you are doing just that disabling security. It's irresponsible to do this when you can solve the issue so simply without disabling security. I'd be surprised if you couldn't be fired at some companies for disabling security.

edited Oct 23 '20 at 16:56

HoldOffHunger

10,963
6
53
100

answered Feb 03 '14 at 03:51

gman

83,286
25
191
301

11

This wouldn't open "your machine" to attacks. A malicious JavaScript code wouldn't be able to do much on the client machine itself. You, however, would allow malicious JavaScript code to potentially manipulate your accounts on other websites (facebook/administrations/banks/...). This certainly isn't any less dangerous, but it's completely different. – dim Apr 27 '17 at 09:07
[Or any 3rdparty library you're including in your local page to upload files from your harddrive to remote servers](http://greggman.github.io/doodles/disable-web-security/). – gman Jun 27 '17 at 09:28
[Here's more proof of concept attacks](https://games.greggman.com/game/dont-disable-web-security/) – gman Jul 18 '17 at 05:25
3

Still, users might need to do this. The issue is not running a server. The issue is testing out CORS before you put it on your acceptance/production server, where this change is not needed. Modifying the hosts file wouldn't work either. – Jeff Huijsmans Jan 30 '19 at 12:34
You can't test CORS without a server because CORS is a server side tech. In order to test CORS you need to setup a server to send CORS headers. There are 2 things to test (1) does the server send the headers (2) if the server sends the headers can you use the resource in the browser. Both (1) and (2) require a server. If you only want to do 2 you can use [this server](https://greggman.github.io/servez/) but you'd still need to test (2) with whatever server is going to server your production site. – gman Jan 30 '19 at 14:30
yeah you can't test your local server with external servers like S3 with a custom domain name. because your local servers domain name is localhost which won't match the domain name of the remote server. that is unless you have some way for me to spin up S3 on my local machine. Also the fact that cors policy exists means that people aren't bothering with these types of attacks because they almost universally fail. (security through obscurity) – denodster Feb 07 '19 at 17:22
Not sure what you meant. You can test any domain name you want locally. You just edit your hosts file (/etc/hosts or C:\Windows\System32\drivers\etc\hosts) and add 127.0.0.1 domainname.com. Don't usually need to though. – gman Feb 08 '19 at 01:59
Web developers need to test frontend client code against alternate servers for a multitude of reasons -- I think that the warning is warranted, but not appropriate as an "answer" – jfunk Aug 22 '19 at 14:32
So if your non tech friends asked a question and the direct answer was "disable your virus scanner and turn off your firewall" but you knew there was a safe, better, indirect answer that more likely than not solved their real issue which would you give them? The person asking the question above, and the majority of people finding it more likely than not needs this answer IMO, not the command line switches. – gman Aug 22 '19 at 16:54
Down voted because it didn't answer the question – John Hardy Dec 24 '20 at 02:59
2

@JohnHardy, Dad: "My daughter broke her arm, how do I fix it?", Me: "Take her to the hospital next door or you'll make it worse". You: "Downvoted because you didn't answer the question" – gman Dec 24 '20 at 04:19
More like: OP: "I understand the risks but I still want to do it. I am an adult." @you: "you can't under any circumstance whatsoever" – John Hardy Dec 25 '20 at 07:02
The OP didn't say they understood the risks. 999 times out of 1000 someone asks that question they don't. – gman Dec 25 '20 at 10:00
@gman No. Downvoted because **there is no hospital next door**. Hospital not available. – Martin Apr 25 '21 at 07:17

score 19 · Answer 13 · answered Mar 02 '17 at 14:21

19

You can use this chrome plugin called "Allow-Control-Allow-Origin: *" ... It make it a dead simple and work very well. check it here: *

answered Mar 02 '17 at 14:21

Mohamed Saleh

2,166
20
31

4

It sets "evil.com" website as a origin, looks suspicious. – Suprido Sep 12 '17 at 13:34
6

No longer functional as per the date of this comment. Would recommend just using the flag route. – N.J.Dawson Aug 06 '18 at 14:57

score 19 · Answer 14 · edited Aug 22 '12 at 10:20

19

For Selenium Webdriver, you can have selenium start Chrome with the appropriate arguments (or "switches") in this case.

 @driver = Selenium::WebDriver.for(:Chrome, { 
       :detach => false,
       :switches => ["--disable-web-security"]
    })

edited Aug 22 '12 at 10:20

WickyNilliams

4,876
1
26
42

answered Mar 27 '12 at 13:07

mikelupo

191
1
2

1

that's two preceeding dashes for disable-web-security. it my browser it made them look like one looong dash. – mikelupo Mar 27 '12 at 13:09
I've wrote a small post about [chrome without cors](https://alfilatov.com/posts/run-chrome-without-cors/) – Alex Filatov Nov 13 '18 at 22:40

score 14 · Answer 15 · answered Jun 15 '12 at 09:46

14

If you are using Google Chrome on Linux, following command works.

google-chrome  --disable-web-security

answered Jun 15 '12 at 09:46

chhantyal

10,570
6
45
71

Shadi Namrouti · Answer 16 · 2020-08-26T21:15:43.793

14

Create a new shortcut:

Paste the following path:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-web-security --user-data-dir="c:\temp\chrome"

Name it:

Unsafe Chrome.exe

Now you have an unsafe version of Google Chrome on desktop to use it for debugging front-end applications without any CORS problems.

edited Aug 26 '20 at 21:15

answered Apr 11 '20 at 20:42

Shadi Namrouti

7,498
1
38
47

score 13 · Answer 17 · answered Sep 12 '14 at 03:29

13

This Chrome plugin works for me: Allow-Control-Allow-Origin: * - Chrome Web Store

answered Sep 12 '14 at 03:29

Bruce

2,036
2
23
20

5

This plugin broke in my browser and started breaking all the XHR things. Use with caution. – etoxin Jan 13 '16 at 23:50
1

This plugin is removed from chrome store – Ashish Kirodian Feb 11 '20 at 07:39

Peter Wilson · Answer 18 · 2019-11-24T04:46:04.343

13

You can simply use this chrome extension Allow-Control-Allow-Origin

just click the icon of the extensnion to turn enable cross-resource sharing ON or OFF as you want

edited Nov 24 '19 at 04:46

answered Jan 29 '15 at 14:49

Peter Wilson

3,738
3
29
52

The link is dead. – Vitaly Zdanevich Nov 23 '19 at 04:24
It is not. And yeah it's working. But we are here cause we now what a command means so use the above solutions before this! – Jánosi-Borsos Róbert Feb 04 '20 at 14:30
@Jánosi-BorsosRóbert who are included in your "we", and how could your knowledge of the meaning of a command bring you here? FYI: Your command is imprecise, and I did not obey ;) – Superole Apr 15 '20 at 20:24
True that @Superole. I meant that I think it's better to use a command than installing an extension. – Jánosi-Borsos Róbert Jun 25 '20 at 16:25
It doesn't work for iframe. It disables only part of CORS – Stanislav Mayorov Oct 05 '20 at 19:14

score 13 · Answer 19 · answered Nov 14 '19 at 20:26

13

For OSX, run the following command from the terminal:

open -na Google\ Chrome --args --disable-web-security --user-data-dir=$HOME/profile-folder-name

This will start a new instance of Google Chrome with a warning on top.

answered Nov 14 '19 at 20:26

Malay

323
4
8

score 12 · Answer 20 · answered May 16 '17 at 09:00

12

FOR MAC USER ONLY

open -n -a /Applications/Google\ Chrome.app --args --user-data-dir="/tmp/someFolderName" --disable-web-security

answered May 16 '17 at 09:00

Saurabh Chandra Patel

9,983
3
77
72

how to revert this change @saurab – Mohasin Ali Dec 21 '17 at 10:03
@MohasinAli close all chrome windows and just run it like normally. It only affects the instance you ran with this argument. If you run it again without any arguments, this change is not applied. – Jeff Huijsmans Jan 30 '19 at 12:32

score 11 · Answer 21 · answered Sep 14 '18 at 04:23

11

On Linux- Ubuntu, to run simultaneously a normal session and an unsafe session run the following command:

google-chrome  --user-data-dir=/tmp --disable-web-security

answered Sep 14 '18 at 04:23

Santiago M. Quintero

931
10
20

score 9 · Answer 22 · edited May 20 '16 at 10:50

9

chromium-browser --disable-web-security --user-data-dir=~/ChromeUserData/

edited May 20 '16 at 10:50

zondo

18,070
7
35
73

answered May 20 '16 at 07:02

MechaCode

166
1
10

guya · Answer 23 · 2016-01-14T21:17:04.407

8

Following on Ola Karlsson answer, indeed the best way would be to open the unsafe Chrome in a different session. This way you don't need to worry about closing all of the currently opened tabs, and also can continue to surf the web securely with the original Chrome session.

These batch files should just work for you on Windows.

Put it in a Chrome_CORS.bat file for easy use

start "" "c:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --user-data-dir="c:/_chrome_dev" --disable-web-security

This one is for Chrome Canary. Canary_CORS.bat

start "" "c:\Users\%USERNAME%\AppData\Local\Google\Chrome SxS\Application\chrome.exe" --user-data-dir="c:/_canary_dev" --disable-web-security

edited Jan 14 '16 at 21:17

answered Jan 14 '16 at 20:31

guya

4,195
33
25

This is a pointless use of a batch file. A shortcut would be much better for this. Just put everything after the first pair of quotes into the shortcut target. – lassombra Jan 10 '17 at 14:29
It doesn't really matter. Yet in a batch you can do more things like deleting the user-data-dir after you close the browser, for example. – guya Jan 14 '17 at 21:21
True, adding behavior outside of just launching would be useful, but for most people who need this at length, having a persistent user directory is helpful (for example with installed extensions) – lassombra Jan 18 '17 at 21:30

score 7 · Answer 24 · answered Dec 29 '15 at 17:16

7

On Windows 10, the following will work.

<<path>>\chrome.exe --allow-file-access-from-files --allow-file-access --allow-cross-origin-auth-prompt

answered Dec 29 '15 at 17:16

ItsAllABadJoke

129
2
4

I am surprised that your answer was downvoted. It worked very well for me on local files with the latest Chrome version. – Waruyama Mar 09 '16 at 10:15
@CHANist: That is perhaps why the OP said, "On Windows **10**"...? – Lawrence Dol Jul 31 '18 at 05:24

score 6 · Answer 25 · answered Aug 31 '16 at 19:41

6

for mac users:

open -a "Google Chrome" --args --disable-web-security --user-data-dir

and before Chrome 48, you could just use:

open -a "Google Chrome" --args --disable-web-security

answered Aug 31 '16 at 19:41

Braian Mellor

1,803
1
26
47

Thanks. This works on the latest Chrome 73 that included the new CORB security policy. – StuyvesantBlue Mar 14 '19 at 10:12

score 6 · Answer 26 · answered Jan 03 '19 at 15:39

this is an ever moving target.... today I needed to add another flag to get it to work: --disable-site-isolation-trials

OS X: open /Applications/Google\ Chrome.app --args --user-data-dir="/var/tmp/Chrome_dev_2" --disable-web-security --disable-site-isolation-trials

score 5 · Answer 27 · answered Dec 11 '16 at 03:21

5

There is a Chrome extension called CORS Toggle.

Click here to access it and add it to Chrome.

After adding it, toggle it to the on position to allow cross-domain requests.

answered Dec 11 '16 at 03:21

Let Me Tink About It

11,866
13
72
169

1

The link is dead. – Vitaly Zdanevich Nov 23 '19 at 04:25

score 5 · Answer 28 · answered Dec 24 '19 at 09:59

5

Used below command in Ubuntu to start chrome (disable same origin policy and open chrome in detached mode):

nohup google-chrome --disable-web-security --user-data-dir='/tmp' &

answered Dec 24 '19 at 09:59

me_astr

784
1
9
20

score 3 · Answer 29 · answered Aug 02 '15 at 06:39

For Windows:

(using windows 8.1, chrome 44.0)

First, close google chrome.

Then, open command prompt and go to the folder where 'chrome.exe' is.

( for me: 'chrome.exe' is here "C:\Program Files (x86)\Google\Chrome\Application".

So I type: cd C:\Program Files (x86)\Google\Chrome\Application )

now type: chrome.exe --disable-web-security

a new window of chrome will open.

score 0 · Answer 30 · edited Feb 20 '14 at 04:05

0

On a Windows PC, use an older version of Chrome and the command will work for all you guys. I downgraded my Chrome to 26 version and it worked.

edited Feb 20 '14 at 04:05

Adam Lear

35,439
12
80
98

answered Feb 18 '14 at 15:42

user1578524

17
1

2

U dont need a older version of chrome use this full command --disable-web-security --user-data-dir="D:/Chrome" – Vignesh S Sep 24 '16 at 13:03

score 0 · Answer 31 · answered Dec 28 '17 at 15:05

I use this sometimes, for posting a localhost front-end site to a localhost back-end API (e.g. React to an old .NET API). I created a separate shortcut on my Windows 10 desktop, so that it never is used for normal browsing, only for debugging locally. I did the following:-

Right click on desktop, add new shortcut
Add the target as "[PATH_TO_CHROME]\chrome.exe" --disable-web-security
Click OK.

You will get a warning on load of this browser, that it is not secure, just take care with what you browser on it. I tend to rename this new shortcut on the desktop, something in capital, and move it away from my other icons, so it can't be confused for normal Chrome.

Hope this helps!

score 0 · Answer 32 · answered Apr 15 '19 at 13:15

0

Try going to this page and disabling the domain security policy for your website domain.

chrome://net-internals/#hsts

answered Apr 15 '19 at 13:15

Rahul Malu

540
2
9

1

Please, explain. At this page at the bottom I see `Input a domain name to delete its dynamic domain security policies (HSTS and Expect-CT). (You cannot delete preloaded entries.):`. – Vitaly Zdanevich Nov 23 '19 at 04:27

score 0 · Answer 33 · answered Feb 22 '21 at 15:42

0

If you use your web server, you ca use Header

On Apache <VirtualHost> or in an .htaccess file.

Header set Access-Control-Allow-Origin 'origin-list'

On Nginx

add_header 'Access-Control-Allow-Origin' 'origin-list'

answered Feb 22 '21 at 15:42

Vitalicus

619
5
14

That doesn't help if you are not the administrator of the website. The enforcement of “Same-origin policy” is a real pain as websites stop working over night. – Martin Apr 25 '21 at 07:07

score -1 · Answer 34 · answered Mar 21 '21 at 07:51

-1

Disable this flag is chrome - chrome://flags/#reduced-referrer-granularity it should work

answered Mar 21 '21 at 07:51

monda

3,529
13
52
80

2

Not seeing that on 89.0.4389.90 – Teku1998 Mar 22 '21 at 11:36

score -3 · Answer 35 · answered Aug 09 '19 at 22:09

-3

The Allow-Control-Allow-Origin plugin for Chrome does not work. This is for MacOS

I added alias chrome='open -n -a /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --args --user-data-dir --disable-web-security' to my .profile as an alias.

The other commands will disable my other extensions and this will boot your normal chrome with cors disabled

answered Aug 09 '19 at 22:09

Mygel Bergstresser

59
1
2

If you just need to test a site with cors, use Safari, where you just need to turn on and off options, instead of launching another instance of the browser: [https://stackoverflow.com/a/12158217/922457] – Edenshaw Sep 27 '19 at 20:32
Do not disable CORS for normal browser, it is unsafe. Do it only for testing/developing your own sites – Michael Freidgeim Nov 27 '19 at 09:03

Disable same origin policy in Chrome

35 Answers35

Update

Linked

Related