search

juliuste / db-prices

Find journey prices using the DB Sparpreise API.
ISC License
102 stars 9 forks source link

CORS security error when running vscode live server in the browser #32

Open bognar-dev opened 1 year ago

bognar-dev commented 1 year ago

Hallo, first of all thanks for this great api, I tried to build a little app/website for my use and when I try to run it in the browser I get a Cross-Origin Resource Sharing (CORS) error. Is there any solution to it?

derhuerst commented 1 year ago

If Deutsche Bahn's API used by db-prices doesn't have CORS enabled (maybe it does?), there is no easy fix for this. (This is the whole point of the CORS security model.)

You can either run db-prices on a server and expose it via a custom API. Or you can set up a CORS proxy specifically for the aforementioned API.

simonhammes commented 1 year ago

I tried to build a little app/website for my use

If you only need it to run on your own machine, you can install a browser extension to disable CORS.

derhuerst commented 1 year ago

If you only need it to run on your own machine, you can install a browser extension to disable CORS.

Note that, unless this browser extension only works for certain origins (more or less domains), this is highly discouraged! It will leave you exposed to various attacks, e.g. any page could query your Gmail inbox.

simonhammes commented 1 year ago

If you only need it to run on your own machine, you can install a browser extension to disable CORS.

Note that, unless this browser extension only works for certain origins (more or less domains), this is highly discouraged! It will leave you exposed to various attacks, e.g. any page could query your Gmail inbox.

You are correct. I should have added that warning myself.