React no access-control-allow-origin header is present on the requested resource.

.net-corefetchreact-nativereactjsrest

Getting below error while i call DotNet core API method from ReactJS post call using Fetch options.

  • ReactJS post call only i am getting this error, below way i was tried.

    • Jquery get/post request – working fine
    • Postman get/post request – working fine
    • Swagger get/post request – working fine
    • ReactJS get request – working fine
    • ReactJS post request – Not working fine

"Access to fetch at 'https://localhost:44352/api/Address/CheckAvailability' from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled."

/*ReactJS Code: */ export function saveAddress(address) { return fetch(baseURL + "Address/CheckAvailability", { method: "POST", headers: { "Access-Control-Allow-Origin": "*", 'Content-Type': 'application/json', 'Accept': 'application/json' }, body: JSON.stringify(address), }).then(handleResponse) .catch(handleError); } /*Dot.Net core Code: */ [HttpPost] public ActionResult CheckAvailability([FromBody]ReqAddressDetailsDto request) { if ((request) == null) { return NotFound(); } return Ok(request); }

Best Solution

If your client application (the React web app) is on another scheme (any of http/https, domain or port is different), you need to have CORS enabled on your ASP.NET Core back-end.

In the Startup.cs file, you need to add this:

In ConfigureServices()

services.AddCors(options => { options.AddDefaultPolicy(builder => { builder.WithOrigins("http://localhost:3000/") .AllowAnyMethod() .AllowAnyHeader(); }); });

In Configure() put this just before app.UseMvc():

app.UseCors();

Check this link for more info: https://docs.microsoft.com/en-us/aspnet/core/security/cors

Im making an API call(Running on another domain) using Fetch in a React Web app. I am getting the error Following error.

Access to fetch at
'——–API URL———' from origin 'http://localhost:3000' has been blocked by CORS policy:
Response to preflight request doesn't pass access control check: No
'Access-Control-Allow-Origin' header is present on the requested
resource. If an opaque response serves your needs, set the request's
mode to 'no-cors' to fetch the resource with CORS disabled.

I have also read several answers on StackOverflow about the same issue, titled "Access-Control-Allow-Origin" but still couldn't figure out how to solve this. I don't want to use an extension IN Chrome or use a temporary hack to solve this. Please suggest the standard way of solving the above issue.

my code looks like this.

{ return fetch('-----------API URL--------', { method:'GET', mode: 'cors', headers:{ 'Access-Control-Allow-Origin':'*' }, }) .then((response) => response.json()) .then((responseJson) => { console.log(responseJson.ALLORDERSRX); this.setState({ isLoading: false, dataSource: responseJson.ALLORDERSRX, }, function(){ }); }) .catch((error) =>{ console.error(error); }); }

Quick answer

The problem here is that you are attempting to use subresource integrity on a resource that is not served with CORS headers.

The short answer is one of

  • Make the server support CORS (only possible if you have control of the server)
  • Stop doing subresource integrity checking (i.e., remove the integrity and crossorigin fields from your <script> elements)
  • Serve the script from a same-origin location (i.e., make the host and domain match between the script location and the page URL)

What's really going on here?

The integrity field of your <script> says "Only load this resource if the SHA384 hash of its contents matches this string: xQae1pUP..."

However, the same-origin policy requires that a script should know as little as possible about a resource served from another origin. Since your code is not running on the origin https://fb.me, it must not learn anything about resources from https://fb.me (unless the server at https://fb.me actively allows this by serving an Access-Control-Allow-Origin CORS header).

However, the subresource integrity mechanism would effectively allow you to inspect the resource with a series of yes/no questions about its contents:

  • "Does the resource's hash match sha384-xQae1pUP...?"
  • "No? Okay, what about sha384-vPt5Lq1...?"
  • "Not that either, huh? Well, could it be sha384-18dh2ca...?"

And so on, until you get the right answer, or at least eliminate a lot of wrong answers.

If the server supports CORS, then the browser will allow your script to read the entire resource anyway, so the browser will certainly also allow your script to determine if the resource's contents hash to a particular value.

How do I enable CORS on Reactjs?

Method to setup CORS requests in react app at front-end level:.
In axios: Axios always use base URL to start the request and the browser confirms that in the beginning HTTP OPTIONS requests by itself. ... .
In fetch: To use CORS in fetch we need to use the mode option and set it to cors..

How do I fix CORS error in react?

CORS Should Always Be Handled From Server Side! set the request's mode to 'no-cors' to fetch the resource with CORS disabled. It states that there's a missing Access-Control-Allow-Origin header on the resource you requested. If you think about it, your client doesn't have anything to do with CORS.

How do I fix CORS header Access

If the server is under your control, add the origin of the requesting site to the set of domains permitted access by adding it to the Access-Control-Allow-Origin header's value. You can also configure a site to allow any site to access it by using the * wildcard. You should only use this for public APIs.

What is CORS in react?

What Is CORS? CORS is a technique that allows you to make an ajax request to a server of a different domain. This is very useful if you want to consume an API directly on your client — something that is absolutely needed if you're writing a Jamstack web app.