FastAPI with Nginx facing CORS issue

Question

When I try to request information from the API, I get CORS policy issue. The API is in different domain and operating system which is linux. The html is in different domain and different operating system which is windows. I tried using Postman to check if the way works, and it was working fine in postman in both server but when i move to html im facing CORS policy issue.

Update: I managed to fix auth issue in Nginx but now im facing content-type issue, not sure where i need to fix issue. I added content-type in Nginx but it didnt work

below is the error im getting when i run button to run the jQuery code

Access to fetch at 'https://{domainName}/api/connect/308' from origin 'http://127.0.0.1:5500' has been blocked by CORS policy: Request header field content-type is not allowed by Access-Control-Allow-Headers

below is the code I used to get request from the server

        jQuery(".chat-icon").click(function () {
            var userId = "308";
            fetch(url + "connect/" + userId, {
                method: "GET",
                mode: "cors",
                headers: new Headers({
                    "Access-Control-Allow-Methods": "POST,GET,OPTIONS, PUT, DELETE",
                    "Access-Control-Allow-Headers":"Origin, X-Requested-With, Content-Type, Accept, Authorization",
                    "auth": "123456",
                    "Content-Type": "application/json; charset=UTF-8",
                }),
            })
                .then(response => response.json())
                .then(json => {
                    jQuery("#starter").text(json.data);
                    jQuery("#displayDateTime").text(today);
                    $("#dt").text(moment().format('hh:mm:ss a'));
                });

Below is fastAPI setup

orgins=['{certain path}','http//127.0.0.1:5500']

The code for FastAPI setup

The code related to the connect function

below is nginx config

location /api/ {
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
    add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type:application/json; charset=UTF-8,auth';
    add_header 'Content-Type' 'application/json charset=UTF-8';

    if ($request_method = 'OPTIONS') {
        add_header 'Access-Control-Allow-Origin' '*';
        #
        # Om nom nom cookies
        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        
        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        
        #
        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
     }
        include proxy_params;
        proxy_pass http://127.0.0.1:5858;
    }

Related answers can be found [here](https://stackoverflow.com/a/73963905/17865804), as well as [here](https://stackoverflow.com/a/75048778/17865804) and [here](https://stackoverflow.com/a/75041731/17865804). — Chris, Feb 01 '23 at 12:19

score 0 · Answer 1 · answered Jan 25 '23 at 18:37

0

add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type:application/json; charset=UTF-8,auth';

The error seems to be that Content-Type:application/json is not a header name, that's a header name and value.

answered Jan 25 '23 at 18:37

Matthias

13,607
9
44
60

hi, thanks for your reply, how can i fix this issue – Hame Jan 25 '23 at 18:40
The `Access-Control-Allow-Headers` header should have a list of header names. `Content-Type` is the header name. – Matthias Jan 25 '23 at 18:42
I tried it but it didnt work. kindly if you can check for me ngnix.conf that i added. I tried with have content-type in 'Access-Control-Allow-Headers' but nothing happens so i tried adding it seperately but it didnt work so latest one i tried adding both of them. still didnt work – Hame Jan 25 '23 at 18:48
I don't know enough to check the nginx config. Can you just check an actual response to see if the right `Access-Control-Allow-Headers` value is present? – Matthias Jan 25 '23 at 19:03
can you explain to me how can I check it . I used postman to check API and it worked fine but issue is that CORS is available in browser and not in postman – Hame Jan 25 '23 at 20:14
`Access-Control-Allow-Headers` is a response header. Check the response, check for `Access-Control-Allow-Headers` in the response headers, and check its value. You may have to send CORS headers in the request like `Access-Control-Request-Headers` (note: `...-Request-...`) – Matthias Jan 25 '23 at 21:31

FastAPI with Nginx facing CORS issue

1 Answers1