Access to XMLHttpRequest at 'https://domain/api/logout/' from origin 'https://domain' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

[laiminhtrung1997]

Please confirm the following

• [X] I agree to follow this project's code of conduct.
• [X] I have checked the current issues for duplicates.
• [X] I understand that AWX is open source software provided for free and that I might not receive a timely response.
• [X] I am NOT reporting a (potential) security vulnerability. (These should be emailed to security@ansible.com instead.)

Bug Summary

After the end-user logout with the API '/api/logout', the issue occurred with a message below.

Access to XMLHttpRequest at 'https://domain/api/logout/' from origin 'https://domain' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

I researched this issue in Envoy, then I configured the Envoy configurations below

routes:
- match
    prefix: "/api/logout"
  route:
    cluster: awx
    timeout: 3600s
    cors:
      allow_origin_string_match:
        - prefix: "https://domain"
      allow_credentials: true
      allow_methods: GET

The issue is still occurring with the other message below.

Access to XMLHttpRequest at 'https://domain/api/' ( redirected from 'https://domain/api/logout/') from origin 'https://domain' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Then I continuing configure the Envoy configurations with the path '/api/' as well. The above message is still occurring.

Could you guy help me to solve this issue? I appreciate it very much. Best regards.

AWX version

23.6.0

Select the relevant components

• [X] UI
• [ ] UI (tech preview)
• [X] API
• [ ] Docs
• [ ] Collection
• [ ] CLI
• [ ] Other

Installation method

kubernetes

Modifications

no

Ansible version

No response

Operating system

No response

Web browser

No response

Steps to reproduce

1. Log in to AWX.
2. Log out from AWX.

Expected results

The end-user can log out without any errors about the cors.

Actual results

The CORS error occurred with the message below.

Access to XMLHttpRequest at 'https://domain/api/logout/' from origin 'https://domain' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Additional information

No response

[fosterseth]

you may need to set these AWX extra settings on your spec file

this setting can also be found in the UI > Settings > Misc System

  extra_settings:
  - setting: CSRF_TRUSTED_ORIGINS
    value:
      - https://yourdomain.com