No 'Access-Control-Allow-Origin' header is present on the requested resource

[danish-din]

🐛 Bug Report

Attempted to follow this but returned an error

Access to fetch at 'https://pwpush.com/p.json' from origin 'https://docs.pwpush.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled

🔬 How To Reproduce

Steps to reproduce the behavior:

Go on Chrome Console and use Javascript snippit provided in guide

Where are you running/using Password Pusher?

• pwpush.com
• Docker Image
  • pwpush
  • Custom image
• Heroku
• Digital Ocean
  • App Platform
  • Kubernetes Service
• Microsoft Azure
  • App Service
  • Container Instances (ACI)
  • Kubernetes Service (AKS)
• Google Cloud
  • App Engine
  • Cloud Run
  • Kubernetes Engine
• AWS
  • Elastic Container Service (ECS)
  • Kubernetes Service (AKS)
• Source Code
• Other (please specify)

If applicable, what version of Password Pusher?

Screenshots

📈 Expected behavior

Return valid API response

📎 Additional context

This was working a few hours ago but stopped working

[github-actions]

Hello @danish-din, thanks for contributing to the Password Pusher community! We will respond as soon as possible.

[pglombardo]

Hi @danish-din - oops & good find. I've updated the documentation to more clearly state that you have to go to the main site (pwpush.com) first.

https://docs.pwpush.com/docs/json-api/#javascript

Thanks for reporting!

[danish-din]

Is it not possible to add the header so i can run it anywhere in chrome.
I am building a chrome extension and this is currently blocking this from working
Thanks!

[pglombardo]

Ah ok - give me a bit to dig into the details & security implications.

[pglombardo]

@danish-din Just an update that I haven't forgotten about this. It's EOD here but this is on my list for tomorrow.

[pglombardo]

Thanks for your patience @danish-din!

I've enabled the CORS header on /p.json only for now (GET, POST & DELETE methods). I'll watch this endpoint this week but if no issues come up, I'll enable it for /f.json and /r.json too.

I tested it myself in the browser console from various other sites and it works here.

Let me know if it works for you!

[danish-din]

Awesome, thank you!

So far so good, will continue to build my extension and see how it goes!