# Cors issue on v8.4.7

**URL:** <https://community.forestadmin.com/t/cors-issue-on-v8-4-7/3791>\
**Category:** Help me!\
**Created:** [November 29, 2021, 12:21pm UTC](https://community.forestadmin.com/t/cors-issue-on-v8-4-7/3791 "2021-11-29T12:21:38Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Houssem\_Yahiaoui](https://dub1.discourse-cdn.com/flex013/user_avatar/community.forestadmin.com/houssem_yahiaoui/32/3156_2.png) [@Houssem\_Yahiaoui](https://community.forestadmin.com/u/Houssem_Yahiaoui)\
**Post date:** [November 29, 2021, 12:21pm UTC](https://community.forestadmin.com/t/cors-issue-on-v8-4-7/3791/1 "2021-11-29T12:21:38Z")

</div>

## Feature(s) impacted

Action

## Observed behavior

Upon Action, on development, I’m getting a Cors problem

## Expected behavior

After upgrading to v8 all is goo in the READ operation, but the Action is returning the CORS problem on development. this is my current cors configurations :

```javascript
    app.use(express.json({
        limit: '50mb'
    }))
    app.use(express.urlencoded({
        extended: false,
        limit: '50mb'
    }))
    app.use(cookieParser())
    app.use(express.static(path.join(__dirname, '..', 'public')))
    let allowedOrigins = ['*.forestadmin.com', '*.run.app'];
    const corsConfig = {
        origin: allowedOrigins,
        allowedHeaders: ['Forest-Context-Url', 'Authorization', 'X-Requested-With', 'Content-Type'],
        maxAge: 86400, // NOTICE: 1 day
        credentials: true,
    };
    app.use('/forest/authentication', cors({
        ...corsConfig,
        origin: corsConfig.origin.concat('null')
    }));
    app.use(cors(corsConfig));
    app.use(jwt({
        secret: process.env.FOREST_AUTH_SECRET,
        credentialsRequired: false,
        algorithms: ['HS256']
    }))

```

## Failure Logs

`Access to fetch at 'http://localhost:3000/forest/actions/actiona-name?timezone=Europe%2F' from origin 'https://app.forestadmin.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.`

Knowing that it was working fine before doing the upgrade, m’i missing anything?

Console log :  
`info : OPTIONS /forest/actions/action-route/action-name?timezone=Europe%2F 200 4 - 57.825 ms`

## Context

I can share all the needed information in Private due to project requirements.

```javascript
"forest-express-sequelize": "^8.4.7",
"express": "~4.17.1"

```

---

<div class="post-metadata">

**Author:** ![anon23361380](https://avatars.discourse-cdn.com/v4/letter/a/67e7ee/32.png) [@anon23361380](https://community.forestadmin.com/u/anon23361380)\
**Post date:** [November 29, 2021, 12:36pm UTC](https://community.forestadmin.com/t/cors-issue-on-v8-4-7/3791/2 "2021-11-29T12:36:41Z")

</div>

Hello @Houssem_Yahiaoui,

All actions are returning a CORS problem? or just a specific one?

---

<div class="post-metadata">

**Author:** ![Houssem\_Yahiaoui](https://dub1.discourse-cdn.com/flex013/user_avatar/community.forestadmin.com/houssem_yahiaoui/32/3156_2.png) [@Houssem\_Yahiaoui](https://community.forestadmin.com/u/Houssem_Yahiaoui)\
**Post date:** [November 29, 2021, 1:04pm UTC](https://community.forestadmin.com/t/cors-issue-on-v8-4-7/3791/3 "2021-11-29T13:04:00Z")

</div>

Hello @anon23361380,

All of them seems to return the cors problem

---

<div class="post-metadata">

**Author:** ![anon79585656](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@anon79585656](https://community.forestadmin.com/u/anon79585656)\
**Post date:** [November 29, 2021, 2:46pm UTC](https://community.forestadmin.com/t/cors-issue-on-v8-4-7/3791/4 "2021-11-29T14:46:31Z")

</div>

Hello @Houssem_Yahiaoui,

Could you please share with us the full request and response for the erroneous OPTIONS call you mentioned?

By any chance, are you using CloudFlare for your project?

Thank you

---

<div class="post-metadata">

**Author:** ![Houssem\_Yahiaoui](https://dub1.discourse-cdn.com/flex013/user_avatar/community.forestadmin.com/houssem_yahiaoui/32/3156_2.png) [@Houssem\_Yahiaoui](https://community.forestadmin.com/u/Houssem_Yahiaoui)\
**Post date:** [November 29, 2021, 3:34pm UTC](https://community.forestadmin.com/t/cors-issue-on-v8-4-7/3791/5 "2021-11-29T15:34:04Z")

</div>

@anon79585656 Yes, CloudFlare is on, but The v5 is working as expected, but the v8 one doesn’t

---

<div class="post-metadata">

**Author:** ![anon79585656](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@anon79585656](https://community.forestadmin.com/u/anon79585656)\
**Post date:** [November 29, 2021, 3:46pm UTC](https://community.forestadmin.com/t/cors-issue-on-v8-4-7/3791/6 "2021-11-29T15:46:32Z")

</div>

@Houssem_Yahiaoui, thank you.

We have some issues with Cloudflare WAF services.

Can you please share the detailed response, to check if it is indeed Cloudflare that causes the issue?

Via your Cloudflare dashboard, you should be able to get the list of the WAF rules triggered by this error. Would you mind sharing it with me (as a DM) so I can send it to our team for investigation?

If this is indeed a Cloudflare issue, for now the only known workaround will be to disable Cloudflare WAF on `/forest` routes

Thank you.

---

<div class="post-metadata">

**Author:** ![Houssem\_Yahiaoui](https://dub1.discourse-cdn.com/flex013/user_avatar/community.forestadmin.com/houssem_yahiaoui/32/3156_2.png) [@Houssem\_Yahiaoui](https://community.forestadmin.com/u/Houssem_Yahiaoui)\
**Post date:** [November 29, 2021, 3:52pm UTC](https://community.forestadmin.com/t/cors-issue-on-v8-4-7/3791/8 "2021-11-29T15:52:03Z")

</div>

@anon79585656  
I actually don’t have a look on that part, but I know about a certain HTML injection problem raised by the action itself, but this was for uploaded files, the normal action used to work fine despite the WAF problem

---

<div class="post-metadata">

**Author:** ![anon79585656](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@anon79585656](https://community.forestadmin.com/u/anon79585656)\
**Post date:** [November 29, 2021, 4:18pm UTC](https://community.forestadmin.com/t/cors-issue-on-v8-4-7/3791/9 "2021-11-29T16:18:30Z")

</div>

@Houssem_Yahiaoui

You should be able to check the response details from your browser developer tools, network tab, when calling the action from your ForestAdmin online project.

---

<div class="post-metadata">

**Author:** ![Houssem\_Yahiaoui](https://dub1.discourse-cdn.com/flex013/user_avatar/community.forestadmin.com/houssem_yahiaoui/32/3156_2.png) [@Houssem\_Yahiaoui](https://community.forestadmin.com/u/Houssem_Yahiaoui)\
**Post date:** [November 30, 2021, 11:23am UTC](https://community.forestadmin.com/t/cors-issue-on-v8-4-7/3791/10 "2021-11-30T11:23:08Z")

</div>

@anon79585656 I’ve sent you on private some metadata, can you please check? and we can take the conversation there?

---

<div class="post-metadata">

**Author:** ![Houssem\_Yahiaoui](https://dub1.discourse-cdn.com/flex013/user_avatar/community.forestadmin.com/houssem_yahiaoui/32/3156_2.png) [@Houssem\_Yahiaoui](https://community.forestadmin.com/u/Houssem_Yahiaoui)\
**Post date:** [December 4, 2021, 2:30am UTC](https://community.forestadmin.com/t/cors-issue-on-v8-4-7/3791/11 "2021-12-04T02:30:14Z")

</div>

Just for documentation :  
I found out the problem, as if you’re using express-cors it will give you many issues, so switch to the cors module and keep the same cors configs and all will be good 🙂