CORS issue in browser

[jussirantala]

Describe the bug Cannot fetch any of the APIs from my browser because: No 'Access-Control-Allow-Origin' header is present on the requested resource.

I have the default conf.yaml which has the following setting: cors: origin.allowed: "*"

Doesn't it mean it should allow my request from my browser?

The requests are fine because I am able to get responses if I use a reverse proxy in between which doesn't care about CORS or certs. However I am building a platform for other people to use and requiring to run a reverse proxy would suck.

[Voyz]

Hey @jussirantala thanks for describing your issue 👍

When you say

Cannot fetch any of the APIs from my browser

What do you mean exactly? How are you calling these APIs?

The Gateway should be usable without a reverse proxy.

[Voyz]

I'm going to close this issue due to inactivity. Thanks for your contribution and please feel free to reopen if you'd like to continue the discussion 👍

[cmmartin]

@Voyz I've got the same issue. I get the following error in the browser...

localhost/:1 Access to fetch at 'https://localhost:5000/v1/api/iserver/secdef/search' from origin 'http://localhost:5173' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource...

I'm also using the default config. The request works using curl but I can see the Access-Control-Allow-Origin response header is not set meaning this will not work in a browser without a reverse proxy.

[Voyz]

@cmmartin I was told by IBKR support to use this extension when trying to test the API from the browser:

https://chromewebstore.google.com/detail/allow-cors-access-control/lhobafahddgcelffkeicbaginigeejlf

[cmmartin]

Okay thanks for the response. I will just build a simple reverse proxy instead