No 'Access-Control-Allow-Origin' with header

Question

I have an HTTPS server thah works, I'm trying to return an answer to the client. I am able to send a GET request from the client, but when I return a response from the server, I continue to get this error:

Failed to load https://localhost:8000/?uname=user&upass=pass: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:63342' is therefore not allowed access.

What am I doing wrong?

this is my server:

var https = require('https');
var fs = require('fs');

var options = {
    key: fs.readFileSync('key.pem'),
    cert: fs.readFileSync('cert.pem')
};

https.createServer(options, function (req, res) {
    res.write('Hello World!'); //write a response to the client
    res.end(); //end the response
}).listen(8000);

and this is my client:

    const xhr = new XMLHttpRequest();
    xhr.onreadystatechange = function () {
        if (xhr.readyState === XMLHttpRequest.DONE) {
            console.log(xhr.responseText);
        }
    };
    xhr.open('GET', `https://localhost:8000?uname=${user}&upass=${pass}`,true);
    xhr.setRequestHeader("Access-Control-Allow-Origin","*");
    xhr.setRequestHeader("Access-Control-Allow-Headers","Content-Type");
    xhr.setRequestHeader("Access-Control-Allow-Methods","GET,POST,PUT,DELETE,OPTIONS");
    xhr.setRequestHeader("ccess-Control-Allow-Credentials","true");
    xhr.send();

Acces control headers have to be on the response from the server, not the request from the client. — Shilly, Jun 07 '18 at 15:22
`res.writeHead()` or something? I do not have the entire node API memorized. — Shilly, Jun 07 '18 at 15:24
The solution is in the first google result for the error message. — , Jun 07 '18 at 15:27
You need to do a bit of research on CORS for the server that you are working on. This is a similar question - https://stackoverflow.com/questions/7067966/how-to-allow-cors, that may help you get on track. — Koji D'infinte, Jun 07 '18 at 15:37

score 3 · Accepted Answer · answered Jun 07 '18 at 15:24

3

Try this on the server, inside your createServer handler, before res.end():

res.setHeader('Access-Control-Allow-Origin', '*');
res.setHeader('Access-Control-Request-Method', '*');
res.setHeader('Access-Control-Allow-Methods', 'OPTIONS, GET, PUT, PATCH, DELETE');
res.setHeader('Access-Control-Allow-Headers', 'authorization, content-type');

answered Jun 07 '18 at 15:24

ouni

3,233
3
15
21

silly me! it works! thanks! – user8446864 Jun 07 '18 at 15:26

No 'Access-Control-Allow-Origin' with header

1 Answers1