# Sudden CORS Error – “No ‘Access-Control-Allow-Origin’ Header” (WebDev doOptions)

**URL:** <https://forum.inductiveautomation.com/t/sudden-cors-error-no-access-control-allow-origin-header-webdev-dooptions/114117>\
**Category:** Ignition\
**Tags:** ignition83, webdev\
**Created:** [February 23, 2026, 6:40am UTC](https://forum.inductiveautomation.com/t/sudden-cors-error-no-access-control-allow-origin-header-webdev-dooptions/114117 "2026-02-23T06:40:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tburgess](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/tburgess/32/67018_2.png) [@Tburgess](https://forum.inductiveautomation.com/u/Tburgess)\
**Post date:** [February 23, 2026, 6:40am UTC](https://forum.inductiveautomation.com/t/sudden-cors-error-no-access-control-allow-origin-header-webdev-dooptions/114117/1 "2026-02-23T06:40:33Z")

</div>

Howdy,

I have an Ignition WebDev API that is being called from a separate frontend built with React/NextJS.

This was working fine previously using my `doOptions` implementation, but when I tested again today, I started getting a CORS policy error stating that no `Access-Control-Allow-Origin` header is present on the response.

Here is my current `doOptions` code:

```python
def doOptions(request, session):
    servletResponse = request["servletResponse"]
    servletResponse.addHeader("Access-Control-Allow-Origin", "*")
    servletResponse.addHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE")
    servletResponse.addHeader("Access-Control-Allow-Headers", "Content-Type, Authorization")
    servletResponse.addHeader("Access-Control-Max-Age", "3600")
    servletResponse.setStatus(200)
    return None

```

I’m not sure what else I should add or check to resolve this. Has anyone run into this before or know what might cause the headers to suddenly stop being included?

Thanks in advance for any help!

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [February 23, 2026, 4:18pm UTC](https://forum.inductiveautomation.com/t/sudden-cors-error-no-access-control-allow-origin-header-webdev-dooptions/114117/2 "2026-02-23T16:18:09Z")

</div>

- Any reverse proxy or anything in front of the servlet?
- Did you recently upgrade Ignition or change your install base in some way?
- Is your options method even being called?
  - If you add logging to the Python code, do you get any output?
  - If you do an OPTIONS request using a tool like `curl`, do you get the expected output?

---

<div class="post-metadata">

**Author:** ![Tburgess](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/tburgess/32/67018_2.png) [@Tburgess](https://forum.inductiveautomation.com/u/Tburgess)\
**Post date:** [February 24, 2026, 12:27am UTC](https://forum.inductiveautomation.com/t/sudden-cors-error-no-access-control-allow-origin-header-webdev-dooptions/114117/3 "2026-02-24T00:27:07Z")

</div>

- No reverse proxy in place

- Nothing has changed with my Ignition install

- interestingly enough, nothing is showing up in my logs when I add them to my doOptions

- when I do `curl -X OPTIONS [my_endpoint] -i` in my terminal I get this in my terminal

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [February 24, 2026, 2:44am UTC](https://forum.inductiveautomation.com/t/sudden-cors-error-no-access-control-allow-origin-header-webdev-dooptions/114117/4 "2026-02-24T02:44:10Z")

</div>

Inheritable project? Are changes in your `GET` or `POST` method reflected if you curl?

---

<div class="post-metadata">

**Author:** ![Tburgess](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/tburgess/32/67018_2.png) [@Tburgess](https://forum.inductiveautomation.com/u/Tburgess)\
**Post date:** [February 24, 2026, 6:01am UTC](https://forum.inductiveautomation.com/t/sudden-cors-error-no-access-control-allow-origin-header-webdev-dooptions/114117/5 "2026-02-24T06:01:12Z")

</div>

Not inheritable, but I just fixed it? I don’t know what really caused it, but this morning I disabled the doOptions, saved the project, and then I reenabled it and saved again, and then suddenly it works again like it did originally. So I guess this is solved now? 🤷‍♂️ Confusing to say the least. Thanks for the help as always though!

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [February 24, 2026, 7:47pm UTC](https://forum.inductiveautomation.com/t/sudden-cors-error-no-access-control-allow-origin-header-webdev-dooptions/114117/6 "2026-02-24T19:47:45Z")

</div>

Well, I'll take it, even if it's not a very satisfying conclusion. Hopefully it doesn't crop up again.