Hello, Hope you are all okay. If you can please take some time and help me figure out what I am doin...

# ktor

[andylamax]

Hello, Hope you are all okay. If you can please take some time and help me figure out what I am doing wrong.

So, I have this

install(CORS) {
    method(HttpMethod.Options)
    method(HttpMethod.Patch)
    method(HttpMethod.Delete)
    header(HttpHeaders.XForwardedProto)
    anyHost()
    header(AccessControlAllowOrigin)
    header(AccessControlAllowMethods)
    header(AccessControlAllowCredentials)
    header(AccessControlAllowHeaders)
    header(AccessControlRequestMethod)
    header(AccessControlRequestHeaders)
    header(AccessControlExposeHeaders)
    header(AccessControlMaxAge)

    allowCredentials = true
    maxAgeInSeconds = 1000
    allowNonSimpleContentTypes = true
}

But I still get this, when I run on the browser. What am I doing wrong? All I need is this request to work

Access to fetch at '<http://192.168.43.218:9010/v1/authorization/user-roles/all>' from origin '<http://localhost:8080>' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Currently on: ktor 1.4.3
Kotlin: 1.4.21

[Jose A.]

Should you add method(HttpMethod.Get)?

[Jose A.]

install(CORS) {
        method(HttpMethod.Options)
        method(HttpMethod.Get)
        method(<http://HttpMethod.Post|HttpMethod.Post>)
        method(HttpMethod.Put)
        method(HttpMethod.Delete)
        header(HttpHeaders.AccessControlAllowHeaders)
        header(HttpHeaders.ContentType)
        header(HttpHeaders.AccessControlAllowOrigin)
        header(HttpHeaders.Authorization)
        anyHost()
        allowCredentials = true
        allowNonSimpleContentTypes = true
    }

I'm using this

[andylamax]

I am actually trying to do a post. But I thought Get and Post where added by default

[andylamax]

let me give it a try

[Jose A.]

header(HttpHeaders.Authorization)

This one is important too

[andylamax]

dang it. That's what I was missing. Thanks much @Jose A.

[andylamax]

worked just when I added it

[Jose A.]

On production anyHost() is not usually a good idea, (because you're disabling cors) check if it's the right thing in your case.

[andylamax]

Yes. I need it. As this is a public rest api. Client apps will connect from different hosts with an authorization token in the header

[andylamax]

Or is there a better approach to accomplish that that I don't know of?

[Jose A.]

If it's a public api then I think it's ok!