Access-Control-Allow-Origin config isn't working

[AlexandreSama]

Current Behavior

After a fresh installation of Pterodactyl as well as Wings and SSL, I tried to modify the allow_origins of the config.yml, found in /etc/pterodactyl, of Pterodactyl hoping to connect with the API and Websocket. Unfortunately, Pterodactyl returns an empty access-control-allow-origin.

My config : https://zupimages.net/up/23/13/elhi.png

The error : https://zupimages.net/up/23/13/jk3k.png

The Response from Pterodatyl : https://zupimages.net/up/23/13/8umt.png

Expected Behavior

Normally, Pterodactyl should have accepted any origin after modification

Steps to Reproduce

Just make a fresh install of Pterodactyl, Wings & SSL Certificats

Panel Version

1.11.3

Wings Version

1.11.5

Games and/or Eggs Affected

No response

Docker Image

No response

Error Logs

No response

Is there an existing issue for this?

• [X] I have searched the existing issues before opening this issue.
• [X] I have provided all relevant details, including the specific game and Docker images I am using if this issue is related to running a server.
• [X] I have checked in the Discord server and believe this is a bug with the software, and not a configuration issue with my specific system.

[AlexandreSama]

fix thanks to a modification of the Pterodactyl.conf file in nginx

You had to modify the fastcgi_param HTTP_PROXY by putting the Origin you want. And just in case, I added an ACAO header with my domain.

Now I get two ACAOs on a query. It works but it's not perfect.

But it shows that the allowed_origins from config.yml in /etc/pterodactyl/ doesn't work at all _I didn't change the allowedorigins, It's the same as the picture above.

[TrixterTheTux]

The allowed_origins is a wings option, and thus only controls wings' CORS. For the panel, there's APP_CORS_ALLOWED_ORIGINS option for .env that instead controls it on the panel's side (or alternatively, you just add the required CORS headers in the panel's webserver config).

[AlexandreSama]

Yeah it's working now if the option, Could we add it in a future update as a comment? To prevent others from losing their hair on it x)