Hi Ory, I am facing issue with CORS when update setting flow. This issue appeared only recently( from 6pm-7pm in timezone+7). I sure CORS on config

custom domains

on

ory.sh

in our app is correct. I not sure but I think my issue is the same with issue below the link. Can Ory help me check it? https://ory-community.slack.com/archives/C02MR4DEEGH/p1691676631318749?thread_ts=1691159789.152689&cid=C02MR4DEEGH

Hi Tan, can you share your cors config please? And your project ID? Regarding the issue from Chris, that was related to an IP being blocked on our end because it looked suspicious. I’m also CC’ing your account executive @stocky-king-5626

our project ID:

59549681-720e-4d4c-98da-a099f09aa7ab

our project slug:

focused-gates-pi4bez4pww

In our

kratos.yaml

, I try set up

cors: enable: true

in that file and push into ory but when I get this config file it return like below. Can you explain this case?

thank you, i will take al look in a bit! for now, can you please try and disable ALL cors settings in your yaml.config? there is currently a issue where if both values are set (in cname AND in the yaml) that that can lead to problems. we’re working on resolving this though.

Hi @high-optician-2097, Thank for your consult but 1. I try to remove config

cors

in yaml file but I get file this config has generate with

false

value(I think this value is default when we do not set up this field(not sure)). 2. The

kratos-auth-staging

in

ory.sh

is default, we can not remove it. When I add more domain, trailling comma will be add in the end of domain.

Thank you, that helps a lot with the investigation!

I try this solution but

cors

issue has exist.

hm, i just checked trhe config for your project and it still shows that the cors setting in the custom domain is set to

[“https://*.<http://luminpdf.com|luminpdf.com>”]

No, I try this config and it not work. I need to revert old config to our QC team can work around with another features(call

whoami

api to check session).

I see, can you explicitly allow-list all domains that you and your team are using? I think the wildcard is causing issues

I updated the config with your suggestion. But I do not know why only

/self-service/settings

were affected with CORS,

whoami api

work normally.

so does it work now? or not?

I saw that headers

Access-Control-Allow-Origin

and

Access-Control-Allow-Credentials

is missing on Post request

Wait! You’re receiving a 502 error. What does the error say?

Oh, I checked it and issue came from

webhook

handler. Because request has

502

error and

cors

issue, this make me confuse so I don't think the

webhook

has a problem. Thanks for your support.