# How to disable CORS policy in POST API in web dev module

**URL:** <https://forum.inductiveautomation.com/t/how-to-disable-cors-policy-in-post-api-in-web-dev-module/64452>\
**Category:** Ignition\
**Created:** [September 25, 2022, 6:45am UTC](https://forum.inductiveautomation.com/t/how-to-disable-cors-policy-in-post-api-in-web-dev-module/64452 "2022-09-25T06:45:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nader.chinichian](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nader.chinichian/32/9261_2.png) [@nader.chinichian](https://forum.inductiveautomation.com/u/nader.chinichian)\
**Post date:** [September 25, 2022, 6:45am UTC](https://forum.inductiveautomation.com/t/how-to-disable-cors-policy-in-post-api-in-web-dev-module/64452/1 "2022-09-25T06:45:07Z")

</div>

Hi,  
I get this error every time I try to access my POST endpoint in the Ignition Web dev module.

```auto
Access to fetch at 'http://127.0.0.1:8088/system/webdev/MES/tags' from origin 'http://localhost:8668' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

```

And this is my code on the client side:

```auto
url = "http://127.0.0.1:8088/system/webdev/MES/tags"

data = { 'nestedResponse': false,
         'paths': [{'recursive': false, 'path': '[default]SIM/realistic'},
                    {'recursive': false, 'path': '[default]SIM/ramp 1'} 
                  ]
       }
fetch(url, {
                mode: 'no-cors',
                method: 'POST',
                headers: {'Content-Type': 'application/json'},
                body: JSON.stringify(data)
})
    .then(res => res.json())
    .then(data => {
                        for (const tag in data.values) {
                            console.log(tag)
                            console.log(data.values[tag])
                        }
                        
                   })

```

As I understand I need to disable the CORS policy mode in server side but I dont know how to do that.

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [September 25, 2022, 2:24pm UTC](https://forum.inductiveautomation.com/t/how-to-disable-cors-policy-in-post-api-in-web-dev-module/64452/2 "2022-09-25T14:24:06Z")

</div>

There doesn't appear to be an easy way to do this, still.

You have to manipulate the response headers yourself instead.

> [@Enable CORS for WebDev](https://forum.inductiveautomation.com/t/enable-cors-for-webdev/38655/4):
>
> Your actual response headers will change based on the input request and what you want to allow it to do. The basic structure should be something like this: from javax.servlet.http import HttpServletResponse servletResponse = request["servletResponse"] servletResponse.addHeader(someCorsHeaders, someCorsValue) # other headers based on incoming request servletResponse.setStatus(HttpServletResponse.SC\_NO\_CONTENT) See [Cross-Origin Resource Sharing (CORS) - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) for reference on what to send…