[Question] CORS

[edwh]

New to API Platform and Symfony, so be gentle. I have an app based on the instructions here; I can use it in local dev but get CORS issues from the Admin when accessing the API after deploying to platform.sh.

I have seen #1199, but that mentions files (e.g. parameters.yml) that don't exist in the sample, and seem to relate to other Symfony setups. I've tried making various changes, but feel like I'm just changing random code without knowing what I'm doing.

So I would be grateful if someone could give me some pointers to enable wildcard CORS on the API of a project generated using API Platform.

[norkunas]

If you are using symfony flex, you should update CORS_ALLOW_ORIGIN in your api .env file

[edwh]

Thanks for your reply. How do I know whether something generated with API Platform is using symfony flex?

I can see that file, but I can see that some people have trouble setting it to a wildcard, e.g. nelmio/NelmioCorsBundle#99 . Would you expect it to work if I just change it to:

CORS_ALLOW_ORIGIN=*

I don't get any Access-Control-Allow-Origin headers back when I try that.

[norkunas]

If it doesnt fixed until now then just replace env var with wildcard :) 2019-02-27, tr 15:51, Edward Hibbert <[email protected]> rašė:

…

Thanks for your reply. How do I know whether something generated with API Platform is using symfony flex? I can see that file, but I can see that some people have trouble setting it to a wildcard, e.g. nelmio/NelmioCorsBundle#99 <nelmio/NelmioCorsBundle#99> . Would you expect it to work if I just change it to: `CORS_ALLOW_ORIGIN=* — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#2564 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACmMODzoxovgvguP8wmJoiaBjyGRVfDbks5vRo13gaJpZM4bUi1E> .

[edwh]

That's what I've tried (I might have edited after you replied).

[norkunas]

You mean you tried:

nelmio_cors:
    defaults:
        origin_regex: true
        allow_origin: ['*']
        allow_methods: ['GET', 'OPTIONS', 'POST', 'PUT', 'PATCH', 'DELETE']
        allow_headers: ['Content-Type', 'Authorization']
        max_age: 3600
    paths:
        '^/': ~

?

[edwh]

Ah, I see what you mean (jn api/config/nelmio_cors.yaml). Bingo, that works. Thank you.