I’m running a canister that serves XRPC endpoints. I’m trying to allow cross-origin requests that include a custom header atproto-accept-labelers. My canister sets these CORS headers: Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: * However, t…

Hey @Gekctek Sorry for the long wait! We have actually deployed it to all HTTP gateways and custom OPTION request responses should be supported now. Let us know whether it works for you!

src/routing/middleware/cors.rs 47b64a062 CorsLayer::new() .allow_origin(Any) .allow_methods(methods.to_vec()) .expose_headers([ ACCEPT_RANGES, CONTENT_LENGTH, CONTENT…

Hey @Gekctek Your observations are 100% correct. The HTTP gateway within the boundary nodes overrides whatever CORS headers you set in your canister. In particular, OPTIONS requests are directly handled by the HTTP gateway and never make it to the canister. Changing that would mean significantly in…

[image] rbirkner: I can check what the possibilities are and will report back! That would be wonderful, thank you

@rbirkner Any update/additional thoughts?

Sorry for taking so long to get back to you: I replied in the other thread , but it also relates to this.

Why does POSTMAN seem to work fine when hitting the ICP http boundary nodes, but browser calls fail?

Hey @Gekctek We have an update for you and the good news is, we will get there, but it will take some time: Currently, the HTTP gateways directly reply to any OPTIONS request with the default headers. We have now updated the behavior such that OPTIONS requests are passed on to the canister. If the…

What kind of requests are you making? Can you provide us with an example please.

I am currently building an http framework in motoko so I’ll be doing all the CORS response headed myself It started as me wanting to integrate into another system that has a custom header, but now it’s more general of needing to handle the OPTIONS preflight in my framework

Out of curiosity: Do you handle certification in your HTTP framework?

CORS Issue: Custom Header Being Blocked by IC Boundary Node

Developers

Gekctek July 16, 2025, 2:48pm 23

This is very blocking for me
Any thoughts on an ETA or workaround

Topic		Replies	Views
Supported HTTP methods for a canister Developers	11	169	March 6, 2025
Access-Control-Allow-Origin Cors error JavaScript	6	1875	May 16, 2023
Boundary node http response headers Developers	78	4580	February 22, 2024
How to add a Response Header after using a custom domain Developers	3	63	August 20, 2024
Default asset canister headers Developers	7	599	November 26, 2024

CORS Issue: Custom Header Being Blocked by IC Boundary Node

Related topics