0
  1. So my website, www.carpediction.com started blocking frontend (hosted on Netlify) requests to the backend node/express server (hosted on Heroku), with no code changes to the CORS setup.

Repo: https://github.com/relativelyIntuitive/CarpeDiction/

  1. This is my CORS setup block in the 'server/server.js' file:

     if (process.env.NODE_ENV === 'production') {
     app.use(cors({ credentials: true, origin: 
          'https://www.carpediction.com' }));
 } else {
     app.use(cors({ credentials: true, origin: 
          'http://localhost:3000' }));
 }

  2. This is the error message logged to the console when accessing www.carpediction.com: "Access to XMLHttpRequest at 'https://carpe-diction.herokuapp.com/api/wotd/latest' from origin 'https://www.carpediction.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource."

  3. My question is this: What is the issue with my current CORS policy setup? The origin listed as blocked in the error message is the same allowed-origin specified in the server's CORS setup, and yet the header is missing. No code was changed in my repo that initiated this issue, one day I just noticed my site wasn't working and investigated. My best guess is that some CORS syntax was changed, but I haven't been able to find any documentation of such a change that would break my server.

  4. If there is any better information I can provide, please let me know! Thanks!

-Zack

P.S.

I even tried to allow all origins with CORS by specifying "*" as the origin in the policy. This still did not work. The error message was the same.

slebetman
  • 109,858
  • 19
  • 140
  • 171
relativelyIntuitive
  • 11
  • 3
  • 2
    What is the specific request you're trying to make that is getting blocked? Have you looked at the network inspector in the browser to see exactly what is getting sent to your server and what is getting returned back? Have you implemented logging on your server to show exactly what requests it receives? Both of these will show you what headers the browser is getting back from the server and will also show whether a pre-flight is being triggered or not - which are all important clues as to what is going on. – jfriend00 Jan 04 '23 at 23:11
  • FYI, the third code block in [this answer](https://stackoverflow.com/questions/74935892/where-are-options-requests-handled-in-express/74946262#74946262) will show you some logging you can add to your server (as the first Express request handler) and then you can see exactly what is being sent to your server and what response it is sending back. – jfriend00 Jan 04 '23 at 23:16

0 Answers0