Cors issue when using API

[emre_sap]

Hello People,

I am wonder if you can help about To use DMC Standard Api services, I tried the package Api services in the Business Accelerator Hub and got the UI5 code for it. I integrated it into my custom plugin, but I am getting an error on the console like this:

pic1.

“ Access to XMLHttpRequest at 'https://api.test.eu10.dmc.cloud.sap/datacollection/v1/groups?plant=1000&group=GLASS%20-%20TEST&_=1689332482793' from origin 'https://dmc-leverx-iksqixkg.test.execution.eu10.dmc.cloud.sap' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. “

I already copied the rest code to UI5 controller from Business Accelerator Hub after getting by test 200 success code:

pic2.

My project was made in Business Application Studio by Yeoman Project and My CORS on mta.yaml file is:

CORS: "[{\"uriPattern\": \"^/yeomanPlugin/(.*)$\",\"allowedOrigin\": [

{\"host\": \"dmc-leverx-iksqixkg.test.execution.eu10.dmc.cloud.sap\",\"protocol\": \"https\"}],

\"allowedMethods\": [\"GET\",\"POST\",\"OPTIONS\"],

\"allowedHeaders\":[\"Origin\", \"Accept\",\"X-Requested-With\",\"Content-Type\",

\"Access-Control-Request-Method\",\"Access-Control-Request-Headers\",\"Authorization\",

\"X-Sap-Cid\",\"X-Csrf-Token\",\"x-dme-industry-type\",\"x-dme-plant\",\"x-features\"],

\"exposeHeaders\": [\"Accept\",\"Authorization\",\"X-Requested-With\",\"X-Sap-Cid\",

\"Access-Control-Allow-Origin\",\"Access-Control-Allow-Credentials\",\"X-Csrf-Token\",

\"Content-Type\",\"x-dme-industry-type\",\"x-dme-plant\",\"x-features\"]}]"

Could you help me if you know how to solve?

King Regards

Emre

[emre_sap]

@amelendez Hi Cors issue is not solved by using the ui5 code snippet given by Api Hub. My advice is just to refer to the DMC Custom Extensions Github package. 

Br,

Emre Yoldas

[emre_sap]

I added this in addition to what API Hub code Snippet gave me but it did not solve

 "Access-Control-Allow-Origin": "*" 

[Ryan-Crosby]

You cannot set this on the client side as that offers no protection for access to the resource. It must be set at the server side that is sharing the resource.

[emre_sap]

Hi Ryan,

Business Accelerator Hub gives constant code snippets, Since the only place we customize is the environment, Do I have to search to set it up by DMC?

Best Regards

[benwildridge]

Hi Emre,

I have done limited things with plugins apart from a little play around but from what I understand is if you have followed Kevin's blog post on setting up a plugin. From there you can just call the internal api name spaces that are just handled by the CORS within the plugin settings as it is not cross domain.

There is an excellent github repository with examples on of custom plugins on, I would recommend going and taking a look at the controller setups in them to see how they are retrieving the data.

CORS issues can be a pain!

[emre_sap]

Thank you Ben,

I will definitely search and work on it.

Best Regards

[amelendez]

Hi @emre_sap
Did you resolve this CORS issue?
I'm in the same situation.

Thanks in advance.
Greetings.