Api-Security

ToolJet makes it very easy to wire up APIs, databases, and internal tools fast. Then CORS shows up and ruins your afternoon. If you are building ToolJet apps that call APIs from the browser, CORS is one of those constraints you cannot brute-force away. You either design around it, proxy around it, or configure it correctly on the server. There is no frontend-only hack that “disables CORS” in production. If somebody suggests a browser extension, close the tab. ...

Discord bot developers hit the same wall over and over: the bot works fine from Node.js, then somebody adds a web dashboard and the browser starts screaming about CORS. I’ve seen this happen with moderation bots, music bots, internal community tools, and “quick” admin panels that turned into production apps. The pattern is predictable: the bot token works on the server somebody tries to call Discord directly from frontend JavaScript preflight requests fail, or worse, the token gets exposed the team starts sprinkling Access-Control-Allow-Origin: * everywhere and hopes for the best That’s not how you want to build a Discord bot dashboard. ...

If you’re debugging “CORS errors with SendGrid webhooks,” there’s a decent chance you’re solving the wrong problem. I’ve seen teams burn hours tweaking Access-Control-Allow-Origin on webhook endpoints that were never meant to be called by a browser in the first place. SendGrid webhooks are server-to-server callbacks. CORS is a browser enforcement layer. Those are two very different worlds. The real mess usually starts when someone tries to involve frontend JavaScript in webhook flows. ...

I’ve seen a lot of teams blame Heroku when their frontend suddenly starts throwing CORS errors after deployment. Usually, Heroku is not the problem. Heroku just makes bad CORS assumptions painfully visible. This case study comes from a very common setup: React frontend on one Heroku app or a custom domain Node/Express API on another Heroku app Everything works locally Production blows up with No 'Access-Control-Allow-Origin' header is present The painful part is that the app often looks fine in Postman, curl, or server-to-server tests. Then the browser blocks it anyway. ...

Shopify webhooks and CORS get mixed up constantly. I’ve seen teams burn hours “fixing CORS” on webhook endpoints that were never touched by a browser in the first place. Shopify sends webhooks server-to-server. Browsers enforce CORS. Those are different worlds. So the short version is: Shopify webhook delivery does not require CORS Your frontend talking to your backend may require CORS Your webhook endpoint should usually not be exposed for browser cross-origin access at all That distinction saves a lot of confusion. ...

A lot of teams treat CORS like a checkbox: add Access-Control-Allow-Origin, ship it, move on. That usually works right up until the frontend needs one custom header, auth cookies enter the picture, or someone decides * is fine everywhere. I’ve seen this go wrong in a very normal setup: a React frontend on app.example.com, an API on api.example.com, and a CDN in front of both. Nothing exotic. The bug report sounded simple: ...

Stripe webhooks and CORS get mixed together constantly, and that usually means someone is solving the wrong problem. I’ve seen this play out the same way more than once: payments work in Stripe Checkout, the webhook endpoint is live, then somebody opens DevTools, sees a failed browser request, and starts adding Access-Control-Allow-Origin: * to the webhook route. A few commits later, webhook signature verification breaks, preflight requests start showing up where they never mattered, and the team is less sure than before what CORS even applies to. ...

A few months ago, I helped clean up a CORS mess on a small API running on Linode Akamai Compute. Nothing exotic: one frontend app, one backend API, both deployed fast, both working fine in local dev, and both breaking the minute a real browser got involved. That’s the pattern with CORS. Curl works. Postman works. Backend logs look healthy. Then the browser says no. This case study is for the setup I see all the time on Linode Akamai Compute: ...

CORS in Django REST Framework looks simple right up until your frontend starts throwing No 'Access-Control-Allow-Origin' header errors and every “quick fix” makes your API less safe. I’ve seen teams handle this in three common ways: disable CORS in development and forget about production slap Access-Control-Allow-Origin: * on everything actually configure it properly with environment-specific rules Only one of those scales without causing pain. The short version If you’re building a DRF API, your realistic CORS options are: ...

A few years ago I helped untangle a Drupal setup that looked fine in local dev and completely fell apart in production. The stack was common enough: Drupal serving JSON:API a separate frontend on another origin authenticated requests for logged-in users some custom headers from the frontend a CDN and reverse proxy in front of Drupal Everybody thought “CORS is enabled” meant the problem was solved. It wasn’t. The symptoms were classic: ...