Unable to authenticate to Moonraker

[rjorgenson]

I get the following error the JS console when attempting to connecting to Moonraker in the UI.

Access to fetch at 'http://fluiddpi.local:7125/access/oneshot_token' from origin 'http://fluiddpi.local:7136' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

This is the relevant section from my moonraker.conf file

[authorization]
force_logins: True
cors_domains:
  *.local
  *.lan
  *://app.fluidd.xyz

trusted_clients:
  10.0.0.0/8
  127.0.0.0/8
  169.254.0.0/16
  172.16.0.0/12
  192.168.0.0/16
  FE80::/10
  ::1/128

It looks like it has all the bits based on what is in the README file (fluiddpi.local is 10.10.10.181). Moonraker has force_logins instead of enabled, this was the default moonraker config that was written. I presume this still allows login with an API key, but maybe that's not enabled by default? I plan to try that but printer is currently printing right now, so will need to wait until that's done. Anything else that might be causing this issue I should be aware of?

[Kragrathea]

If you are using an API Key then the moonraker configuration looks right.

If you are using the latest version (released tonight) then you can set the API key in the connection dialog. There are also updated instructions on how to get the API key from Fluidd.

That dialog will also have a full connection log. If you are still having trouble post the entire log here and I will take a look.

[rjorgenson]

KIAUH says I'm running the latest version (v0.11-32) and I do have a connection dialog, it doesn't give the error about the header though just says it was unable to connect. These errors are also all in the console.

Here is the full log of errors from the console as well.

[Kragrathea]

Ah! I think I found the problem. You need to make sure the domain you are browsing from is in the moonraker.conf cors_domains: section. In my case I forgot I put a "*" there that covers every domain. Could you try configuring yours like this to see if it fixes the problem?

# From moonraker.conf
[authorization]
...
cors_domains:
  *.local
  *.lan
  *://app.fluidd.xyz
  *  #<--Allow all domains

[rjorgenson]

@Kragrathea Addding the * did the trick. But if the request is coming from fluiddpi.local why wouldn't the *.local directive allow that domain? Is there a way to see what domain the request is actually coming from rather than what my browser recognizes it as?

[Kragrathea]

Good question. After trying a few things it looks like the port is causing issues. This will work instead of "*".

cors_domains:
  *.local
  *.local:*

I am not sure it this is a bug in moonraker or if it is the intended behavior. I'll ask them...

Thanks for helping track down the problem!

[rjorgenson]

No problem, I also confirmed that *.local:* worked for me too. Thanks!