Http-server: [Question] How to set cors headers?

[gagan-bansal]

I want to set cors header
Access-Control-Allow-Origin: *.mydomain.com

How can it be set?
Tried with --cors, but not able to set.
--cors='Access-Control-Allow-Origin: *.mydomain.com'

[jeffbroadhurst18]

I am having the same issue. Please can you provide an example of how to use the --cors option. Thanks

[derhuerst]

With --cors:

< Access-Control-Allow-Origin: *
< Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Range

With --cors=Foo:

< Access-Control-Allow-Origin: *
< Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Range, Foo

It doesn't seem to work with --cors foo.

With --cors=Foo,Bar:

< Access-Control-Allow-Origin: *
< Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Range, Foo, Bar

[bardiarastin]

@gagan-bansal @jeffbroadhurst18 use :
http-server --cors='*'

[dirkteucher]

None of these solutions seem to work when a child iframe is trying to access javascript objects in its parents container. Anyone have an idea why not?

[dirkteucher]

I found a hacky solution to work around this problem temporarily.

From CMD run the following:
Linux
chromium-browser --disable-web-security --user-data-dir
Windows
chrome.exe --disable-web-security --user-data-dir
Mac
open -a Google\ Chrome --args --disable-web-security --user-data-dir

This gets rid of ALL chromes security so use with caution.

I would still like to know how to correctly allow iframe cors in http-server under the scenario I outlined in my last comment.

[michaelpalumbo]

Hi there, this is also presenting as an issue for me. I have tried each of the above-suggested cli flags to no avail. (I'm on osx sierra, fyi)

edit: so I tried loading my page in firefox and it worked. so the --cors setting in chrome is still an issue.

[imsontosh]

Hi, None of the solution works for me with Chrome :(

[Farham0]

Not worked for me chrome :(

I checked this chrome extension also
https://chrome.google.com/webstore/detail/allow-control-allow-origi/nlfbmbojpeacfghkpbjhddihlkkiljbi?hl=en

[UlyssesInvictus]

I was having issues as well, but this other thread pointed out that it's actually likely just browser caching behavior, and it was fixed for me when I used --cors=* with a hard cache refresh (in Chrome). The =* may not even be necessary, I didn't bother to test it.

[SujayKrishnan]

Successfully working in Chrome; thanks all. I used Visual Studio Code (I have package npm http-server) and simply keyed in Terminal as follows: http-server --cors=*. Note: it does not work without =*

[alicegherbison]

Hi there,
I am also having this issue. None of http-server --cors=*, http-server --cors='*' or http-server --cors (plus using hard refreshes) work in Chrome or Firefox to resolve it. Running OSX High Sierra.

[csakaszamok]

Hi there,
I am also having this issue. None of http-server --cors=*, http-server --cors='*' or http-server --cors (plus using hard refreshes) work in Chrome or Firefox to resolve it. Running OSX High Sierra.

same problem here
on osx does not not work the cors option

[PaTiToMaSteR]

that options against chrome don't work. confirmed, no matter the options :)

[peterjhart]

The only way that works for me (so far) is just --cors
http-server version: 0.12.1
node: 12.14.1
Chrome: 79.0.3945.130
macOS: 10.14.6 Mojave

Package script:

"serve": "http-server ./build -p 5625 --cors"

[zteater]

Hi there,
I am also having this issue. None of http-server --cors=*, http-server --cors='*' or http-server --cors (plus using hard refreshes) work in Chrome or Firefox to resolve it. Running OSX High Sierra.

http-server --cors worked for me after a hard refresh as you suggested.