Problem with API cloud - CORS

Help Orchestrator
, ,
1

Hi guys,
I have a problem consuming API orchestrator cloud with javascript, I receive error with CORS, the message is: Access to fetch at ‘https://account.uipath.com/oauth/token’ from origin ‘null’ has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. If an opaque response serves your needs, set the request’s mode to ‘no-cors’ to fetch the resource with CORS disabled.
I use the URL https://account.uipath.com/oauth/token
Thanks for any help.

2

Hi @Juan_Carlos_Salazar

Does this help? :slight_smile:

3

The Same Origin Policy (SOP) is the policy browsers implement to prevent vulnerabilities via Cross Site Scripting (XSS). In other words, the browser would not allow any site to make a request to any other site. It would prevent different origins from interacting with each other through such requests, like AJAX. This policy exists because it is too easy to inject a link to a javascript file that is on a different domain. This is a security risk - you really only want code that comes from the site you are on to execute and not just any code that is out there.

The Cross Origin Resource Sharing (CORS) is one of the few techniques for relaxing the SOP. Because SOP is “on” by default, setting CORS at the server-side will allow a request to be sent to the server via an XMLHttpRequest even if the request was sent from a different domain. This becomes useful if your server was intended to serve requests from other domains (e.g. if you are providing an API).

JSON with Padding is just a way to circumvent same-origin policy, when CORS is not an option. This is risky and a bad practice. Avoid using this.

If you want to bypass that restriction when fetching the contents with fetch API or XMLHttpRequest in javascript, you can use a proxy server so that it sets the header Access-Control-Allow-Origin to *.

If you need to enable CORS on the server in case of localhost, you need to have the following on request header.

Access-Control-Allow-Origin: http://localhost:9999

4

Hii, I am trying to use the access token which i got through a fetch api call. However if i use the token to access the uipath resources i get the CORS error. I’m sharing my code snippet below. Kindly help me out in whatever way possible.

function getAOuth ()

{

     fetch('https://cloud.uipath.com/identity_/connect/token',params).then((response)=>

{

        return response.json();

}).then((data)=>{

   

    // console.log(string);

    console.log(data);

    // Store token data

   const token = data.access_token;

   const tokenType = data.token_type;

   console.log(token);

   console.log(tokenType);

   auth_params = {

       method:'GET',

       headers:{

           'Authorization' :'Bearer'+' '+token,

           'Access-Control-Allow-Origin': 'http://localhost:9999'

        //    'Access-Control-Allow-Methods': 'POST, GET, OPTIONS'

       }

   }

   fetch('https://cloud.uipath.com/kilowbfinura/GauriDangui/odata/Folders',{mode:'cors'},auth_params).then((response)=>

   {

       console.log("Entered the second fetch")

            return response.json();

   }).then((data)=>{

       console.log('Inside 2nd fetch');

       console.log(data);

   })

The params contain the headers and body as below

params ={

    method:'POST',

    headers:{

        'Content-Type':'application/x-www-form-urlencoded; charset=UTF-8'

    },

    body: new URLSearchParams({

        "grant_type": "client_credentials",

        "client_id": "***",

        "client_secret": "***",

    })

}