# DF2: CORS / No 'Access-Control-Allow-Origin' header is present **URL:** \ **Category:** Authentication & Security\ **Created:** [January 25, 2016, 8:57am UTC](https://community.dreamfactory.com/t/df2-cors-no-access-control-allow-origin-header-is-present/2084 "2016-01-25T08:57:22Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Martin\_Jansen](https://avatars.discourse-cdn.com/v4/letter/m/f05b48/32.png) [@Martin\_Jansen](https://community.dreamfactory.com/u/Martin_Jansen)\ **Post date:** [January 25, 2016, 8:57am UTC](https://community.dreamfactory.com/t/df2-cors-no-access-control-allow-origin-header-is-present/2084/1 "2016-01-25T08:57:22Z")
I have the following setup: DF2 Installed from Bitnami. Admin Application Version: 2.0.6 DreamFactory Version: 2.0.3 DB Service: Link to a MySQL DB FIles Service: Link to Amazon S3 File Storage When trying to retrieve a file, I get the error: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘[http://127.0.0.1:49806](http://127.0.0.1:49806)’ is therefore not allowed access. And my CORS is enabled as: Origin: \* Paths: api/v2/\* Headers: \* Max Age: 0 For all the verbs (GET, POST…) Please tell me what I’m doing wrong? ---
**Author:** ![bitperbit](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/bitperbit/32/490_2.png) [@bitperbit](https://community.dreamfactory.com/u/bitperbit)\ **Post date:** [January 25, 2016, 9:40pm UTC](https://community.dreamfactory.com/t/df2-cors-no-access-control-allow-origin-header-is-present/2084/2 "2016-01-25T21:40:52Z")
Hi, I think this is a new bug, After updating from ver 2.0.1 to 2.0.4 I have the same issue. The problem is that it does it 3 times out of 5. This is what I get in the login request: > XMLHttpRequest cannot load [http://v2.amicido.it:8080/api/v2/user/session](http://v2.amicido.it:8080/api/v2/user/session). No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘[http://localhost](http://localhost)’ is therefore not allowed access. If I repeat the call it works. The CORS setup is setup to allow everything ![](https://canada1.discourse-cdn.com/flex035/uploads/dreamfactory/original/1X/d8052f8acecd03d8fb32276898fd22c3eea4bc3e.png) If I roll back to v 2.0.1 it works properly. I have filed a bug-fix request [here](https://github.com/dreamfactorysoftware/dreamfactory/issues/27). ---
**Author:** ![Navin\_Agarwal](https://avatars.discourse-cdn.com/v4/letter/n/e19adc/32.png) [@Navin\_Agarwal](https://community.dreamfactory.com/u/Navin_Agarwal)\ **Post date:** [February 15, 2016, 6:45am UTC](https://community.dreamfactory.com/t/df2-cors-no-access-control-allow-origin-header-is-present/2084/3 "2016-02-15T06:45:06Z")
I am also facing the same issue when trying to get image from Amazon S3 using Angular js SDK. But login is working fine in my case and also get image is working fine if i use POSTMAN rest client. My dreamfactory version is 2.0.2. Have you found any solution? ---
**Author:** ![mrjohny](https://avatars.discourse-cdn.com/v4/letter/m/46a35a/32.png) [@mrjohny](https://community.dreamfactory.com/u/mrjohny)\ **Post date:** [August 22, 2016, 9:09am UTC](https://community.dreamfactory.com/t/df2-cors-no-access-control-allow-origin-header-is-present/2084/4 "2016-08-22T09:09:33Z")
Was this fixed for you guys in version 2.1? ---
**Author:** ![windsorperma](https://avatars.discourse-cdn.com/v4/letter/w/4af34b/32.png) [@windsorperma](https://community.dreamfactory.com/u/windsorperma)\ **Post date:** [April 10, 2020, 5:55pm UTC](https://community.dreamfactory.com/t/df2-cors-no-access-control-allow-origin-header-is-present/2084/5 "2020-04-10T17:55:31Z")
This is happening because of the [CORS](http://net-informations.com/js/err/xml.htm) (Cross Origin Resource Sharing) . For every HTTP request to a domain, the browser attaches any HTTP cookies associated with that domain. This is especially useful for authentication, and setting sessions. You are doing an XMLHttpRequest to a different domain than your page is on. So the browser is blocking it as it usually allows a request in the same origin for security reasons. You need to do something different when you want to do a cross-domain request. JSONP ( JSON with Padding ) is a method commonly used to bypass the cross-domain policies in web browsers. You’re on domain [example.com](http://example.com) , and you want to make a request to domain example.nett . To do so, you need to cross domain boundaries. JSONP is really a simple trick to overcome the XMLHttpRequest same domain policy. So, instead of using XMLHttpRequest we have to use \< script \> HTML tags, the ones you usually use to load JavaScript files , in order for JavaScript to get data from another domain. **Localhost** If you need to enable CORS on the server in case of localhost, you need to have the following on request header. `Access-Control-Allow-Origin: http://localhost:9999`