0

I have local app. What I've tried so far

  1. Installed CORS extension (helped me to get token from back-end without being blocked)

  2. I had to pass this token as X-API-Token to call my next API but I get error written in title.

  3. I tried to pass to headers

axios.get( `/booking/`, { headers: 
        {
        'X-API-Token': state.session.token, 
        'Access-Control-Allow-Origin':'*', 
        'Access-Control-Allow-Methods': 'GET', 
        'Access-Control-Allow-Headers': 'Origin, Content-Type, X-API-Token'
        }
    })

Also doesn't work. I don't have access to server side. Is there any way handling it from Front-end? Or at least not blocked from localhost for now?

David Buck
  • 3,439
  • 29
  • 24
  • 31
curiosity
  • 9
  • 1
  • 2

2 Answers2

-1

The access control check is a security feature of the browsers, so be careful what you enable/disable in the servers.

This is a production express nodejs app being served by Apache. Bear in mind that the browsers are caching the headers, so you should need to hard refresh and reload in order to get it working.

Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Methods "GET,PUT,POST,DELETE,OPTIONS"
Header always set Access-Control-Allow-Headers "Content-Type,Authorization"

Header always set Access-Control-Request-Method "POST, GET, OPTIONS, DELETE, PUT"
Header always set Access-Control-Allow-Credentials "true"
Ilia Hanev
  • 43
  • 7
-2

This answer solved my problem ( Disable same origin policy in Chrome) For Windows:

  • Open the start menu

  • Type windows+R or open "Run"

  • Execute the following command:

    chrome.exe --user-data-dir="C://Chrome dev session" --disable-web-security

curiosity
  • 9
  • 1
  • 2