# Enable CORS for WebDev

**URL:** <https://forum.inductiveautomation.com/t/enable-cors-for-webdev/38655>\
**Category:** General Discussion\
**Created:** [September 14, 2020, 5:00pm UTC](https://forum.inductiveautomation.com/t/enable-cors-for-webdev/38655 "2020-09-14T17:00:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeff.m.miller](https://avatars.discourse-cdn.com/v4/letter/j/3be4f8/32.png) [@jeff.m.miller](https://forum.inductiveautomation.com/u/jeff.m.miller)\
**Post date:** [September 14, 2020, 5:00pm UTC](https://forum.inductiveautomation.com/t/enable-cors-for-webdev/38655/1 "2020-09-14T17:00:34Z")

</div>

I have a Web app that i am trying to make ajax calls to an ignition WebDev. These call are failing on the options call. These are in another domain, so need to enable the option replay and enable CORS to allow \* orgins.

On Linux Ignition 8.0.15. How do i enable CORS allow \* orgins, the other CORS related headers for all webdev call made?

I tried editing the web.xml file, but Ignition failed to start after copy paste of xml from another post. That post was related to an older version of Ignition. So guessing is not longer valid method.

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [September 14, 2020, 5:18pm UTC](https://forum.inductiveautomation.com/t/enable-cors-for-webdev/38655/2 "2020-09-14T17:18:07Z")

</div>

There’s no blanket way to do it, but you can implement a `doOptions` header that returns the values you need. I’d recommend doing it in a project script, so you can just copy the call to that function into each Python handler you have.

---

<div class="post-metadata">

**Author:** ![Ricardo\_Sanchez](https://avatars.discourse-cdn.com/v4/letter/r/da6949/32.png) [@Ricardo\_Sanchez](https://forum.inductiveautomation.com/u/Ricardo_Sanchez)\
**Post date:** [November 17, 2021, 8:42am UTC](https://forum.inductiveautomation.com/t/enable-cors-for-webdev/38655/3 "2021-11-17T08:42:32Z")

</div>

do you have any example?

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [November 17, 2021, 3:26pm UTC](https://forum.inductiveautomation.com/t/enable-cors-for-webdev/38655/4 "2021-11-17T15:26:50Z")

</div>

Your actual response headers will change based on the input request and what you want to allow it to do.  
The basic structure should be something like this:

```auto
from javax.servlet.http import HttpServletResponse

servletResponse = request["servletResponse"]
servletResponse.addHeader(someCorsHeaders, someCorsValue)
# other headers based on incoming request
servletResponse.setStatus(HttpServletResponse.SC_NO_CONTENT)

```

See [Cross-Origin Resource Sharing (CORS) - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) for reference on what to send in the response.

---

<div class="post-metadata">

**Author:** ![bao.nguyen](https://avatars.discourse-cdn.com/v4/letter/b/8c91f0/32.png) [@bao.nguyen](https://forum.inductiveautomation.com/u/bao.nguyen)\
**Post date:** [August 15, 2023, 2:33am UTC](https://forum.inductiveautomation.com/t/enable-cors-for-webdev/38655/5 "2023-08-15T02:33:15Z")

</div>

Hi Paul,

Thank you for your guide.  
I manage to enable CORS in my WebDev doGet() with the below codes.

Hope this will help others too.

```
#modify response headers
servletResponse = request["servletResponse"]
servletResponse.addHeader("Access-Control-Allow-Origin", "*") #allow API calls from other hosts in addition to that of the gateway

tag = system.tag.readBlocking(['[default]zTest/int2'])[0].value
json = {'tag': tag}
return {'json': json}

#This response can be retrieved with fetch() in JavaScript.

```