https://cerbos.dev logo
Join SlackCommunities
Powered by
Hello! I'm having an issue with our Cerbos deploym...
# help
a
Hello! I'm having an issue with our Cerbos deployment. Somehow 
Access-Control-Allow-Origin
header is being sent twice, which then throws a CORS error for any request sent to it.
Copy code
Access to fetch at '<https://zephyr-cerbos-dev.zephyr-cloud.io/api/check/resources>' from origin '<http://localhost:3000>' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values '*, <http://dev.zephyr-cloud.io|dev.zephyr-cloud.io>', but only one is allowed. Have the server send the header with a valid value, or, if an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
What's the fastest way to debug and solve this issue?
d
Hi Arthur! What’s in the 
server -> cors
section of your Cerbos config?
Also, what are the CORS settings of the API Gateway?
a
OK that duplicated cors value problem was another team member testing our gateway headers configuration to see if there was anything suspicious there. The real problem (when nothing custom is set on our nginx gateway) is that 
OPTIONS
requests have no 
CORS
headers in the response.
that's our server config:
Copy code
server:
  adminAPI:
    enabled: true
    adminCredentials:
      username: <username>
      passwordHash: <hash>
nothing related to cors at all
`POST`/`GET`... requests were returning allow origin = 
*
but our problem was that on Firefox browsers a preflight request was being made (on Chromium only the 
POST
is being sent) and in this OPTIONS request, a 
501 Method Now Allowed
was being sent without any cors headers
We temporarily solved this by adding a "if method === OPTIONS reply with cors headers" in our reverse proxy but I think this shouldn't be the final solution
d
Can you add this 
cors
section to your server config?
Copy code
server:
  cors: # CORS defines the CORS configuration for the server.
    allowedHeaders: ['content-type', 'user-agent'] # AllowedHeaders is the contents of the allowed-headers header.
    allowedOrigins: ['*'] # AllowedOrigins is the contents of the allowed-origins header.
    disabled: false # Disabled sets whether CORS is disabled.
    maxAge: 10s # MaxAge is the max age of the CORS preflight check.
Open in Slack
PreviousNext
Powered by