CORS support for API

[yuri]

https://github.com/espocrm/espocrm/issues/2755

[Gunjan Gupta]

Tarsam - I am working with Red Cross to embed EspoCRM in Twilio Flex using iFrame. The Red Cross team is using the hosted version https://docs.espocrm.com/administrat...ion-by-script/ . Do you have any instructions on how they can disable CORS on their hosted version?

[esforim]

Hi all, manage to fixed it here with solution: https://forum.espocrm.com/forum/gene...3921#post73921

[esforim]

Hi guys, reviving this thread to see if anyone manage to get some success, I"m currently playing with an low-code software call AppGyver ( https://platform.appgyver.com/ ), getting stuck linking to EspoCRM API, work fine if using Postman but always issue when trying to get API working elsewhere.

Anyone know how to solve this issue or know how it can be done?

The error I get when I do a test is:
Error: TypeError: Failed to fetch. Does the server allow CORS?status: undefined

Doing a search and came across this thread which is quite old so not sure if still valid.

[gundogduyakici]

There is no problem with EspoCRM. I am logging in via the EspoCRM API. mikeg13

[mikeg13]

gundogduyakici - is this on your own implementation or on a hosted EspoCRM instance? I was able to get it working by deploying on my own server, but doesn't look like Espo-hosted will do it?

[gundogduyakici]

I experienced this problem. You need to get it with the Get parameter and place the headers properly. mikeg13 If you write sample codes, we can help.

[brianpunzalan]

mikeg13 You could try to enable it manually but this would be a technical debt since they mentioned that it is a security risk.

Check this link. https://github.com/espocrm/espocrm/issues/270

[mikeg13]

We are using the API. The API is returning this...

[tarasm]

CORS is not supported for security reason. To get data from EspoCRM use API https://www.espocrm.com/documentation/development/api/.

[mikeg13]

We're looking to embed some EspoCRM data in another application.

Postman works fine, but in a browser console we're getting this:
Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:3000' is thereforenot allowed access. The response had HTTP status code 401. If an opaque response serves your needs, set the request's mode to "no-cors' to get the resource with CORS disabled.

Does Espo's API support CORS? If not, how would anyone use it outside of Postman or just extracting data from a non-web-app?

thanks,
Mike