build with wasm target works, but fail to run because CORS

[derust]

Access to fetch at 'https://api.cloudflare.com/client/v4/zones' from origin 'http://lo:8000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Do api.cloudflare.com have any setting to bypass CORS restriction?

[nilslice]

@derust - I will check with the API team internally and see if this is intentional, or a configuration on a per-endpoint basis. Thanks for reporting, and sorry for the delay!

If this is blocking you, would it be possible in your system to add a Cloudflare Worker as a minimal proxy between your client and the Cloudflare API?

[jacobbednarz]

👋 we don't currently have CORS support on the API but i'd be interested in how you were thinking about doing this because if you need CORS, that also means you're doing this in the frontend/browser and exposing your credentials at the same time (as all the endpoints are authenticated). If you're using a frontend/backend combo, you'll want to move this to the backend and have it make the requests working around the need for CORS.

[derust]

@nilslice
thank you, I already do that

@jacobbednarz
the use case is:
I was made a SPA to help users manage their resources,
specifically, an acme-client running in browser, which use cloudflare dns api handle DNS01 challenge.

the credentials is saved locally and never leaves users browser

If there is no CORS restriction , the wasm version of this crate will be more useful

[jacobbednarz]

thanks, i'll add a note to our internal ticket of your use case but i can't guarantee whether this will change or provide an ETA on when this will land if it's decided on.