Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

CORS Misconfiguration

See original GitHub issue

Hello,

I am working with some of the Grocy API’s and am running into CORS issues. I see from this line https://github.com/grocy/grocy/blob/master/routes.php#L252 that you are adding some middleware to handle the request, but OPTIONS requests are all failing.

Making a request to OPTIONS http://localhost/api/objects/locations results in a response of Allowed methods: GET, POST.

I got this error or a similar one using the LinuxServer and the grocy provided docker images

Issue Analytics

State:
Created 3 years ago
Comments:15 (7 by maintainers)

Top GitHub Comments

1reaction

berrndcommented, May 19, 2020

Thank you, I created #861 to track that there.

1reaction

berrndcommented, Apr 22, 2020

This should now be finally fixed, the Access-Control-Allow-Origin apparently needs also be included in content responses, not only for the OPTIONS request…

Both provided examples above (test via browser console & StackBlitz) work now.

If you want to have it now, replace middleware/CorsMiddleware.php and middleware/JsonMiddleware.php.

Top Results From Across the Web

What is CORS (cross-origin resource sharing)? - PortSwigger

CORS vulnerabilities arise primarily as misconfigurations. Prevention is therefore a configuration problem. The following sections describe some effective ...

CORS Misconfiguration - Application Security Cheat Sheet

Cross-origin resource sharing (CORS) is a browser mechanism which enables controlled access to resources located outside of a given domain.

【CORS Error】Misconfigurations and their impacts

A cross-origin resource-sharing misconfiguration occurs when the web server allows third-party domains to perform privileged tasks through the ...

CORS - Misconfigurations & Bypass - HackTricks

The CORS (Cross-origin resource sharing) standard is needed because it allows servers to specify who can access its assets and which HTTP request...

3 Ways You Can Exploit CORS Misconfigurations | we45 Blogs

CORS Misconfigurations : Three Attack Scenarios · 1. Exploiting misconfigured wildcard (*) in CORS Headers · 2. Trusting pre-domain wildcard as ...