'CORS Missing Allow Origin' response despite settings aligned to documentation and links about django-cors-headers HOT 6 CLOSED

SAME!!

Edit: I read the code of CorsMiddleware and for some reason it checks for Origin header, and if there's no Origin header, it just returns the view. I checked, and my browser didn't provide it. I guess it is a CORS spec? ;)

from django-cors-headers.

Hi, one of the official Docker examples for Django adds local host to the environment file as seen here https://github.com/docker/awesome-compose/blob/master/django/app/example/settings.py#L37. I don’t use Docker but this may be worth a try.

from django-cors-headers.

@itekhi - Is there something you have implemented to resolve this for a specific origin?

from django-cors-headers.

@outwrq Hello, I did not. I guess Origin header is only sent by the browser when making cross-origin requests. So I didn't want to put a security hole in my app, so I just switched to Token-based authentication :)

from django-cors-headers.

Looking into this further, your developer tools screenshot displays that you're running a JavaScript file that is making a fetch request to another site. If you look in the Dev Tools console you'll see a more detailed error. If you see an error like:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at [the site fetch() is attempting to access]  (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 200.

you need to add the specific site to CORS_ALLOWED_ORIGINS in the Django settings file. More info can be found here https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSMissingAllowOrigin.

from django-cors-headers.

Please read the resources: https://github.com/adamchainz/django-cors-headers#about-cors .

from django-cors-headers.