# Akka HTTP CORS headers not being set

**URL:** <https://discuss.akka.io/t/akka-http-cors-headers-not-being-set/9602>\
**Category:** Akka Libraries\
**Tags:** akka, akka-http\
**Created:** [March 12, 2022, 7:08pm UTC](https://discuss.akka.io/t/akka-http-cors-headers-not-being-set/9602 "2022-03-12T19:08:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gerhynes](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.akka.io/gerhynes/32/2818_2.png) [@gerhynes](https://discuss.akka.io/u/gerhynes)\
**Post date:** [March 12, 2022, 7:08pm UTC](https://discuss.akka.io/t/akka-http-cors-headers-not-being-set/9602/1 "2022-03-12T19:08:31Z")

</div>

I’m attempting to use [akka-http-cors](https://github.com/lomigmegard/akka-http-cors) to implement CORS while connecting a React app running on localhost:3000 to an Akka HTTP REST API running on localhost:8080.

I’ve followed the documentation but it doesn’t seem that the ‘Access-Control-Allow-Origin’ header is being sent.

The response headers I’m getting when making a POST request to the Akka HTTP API are:

```auto
HTTP/1.1 400 Bad Request

    Server: akka-http/10.2.7

    Date: Sat, 12 Mar 2022 18:50:21 GMT

    Content-Type: text/plain; charset=UTF-8

    Content-Length: 124

```

While the request headers are:

```auto
POST /api/posts HTTP/1.1

    Host: localhost:8080

    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0

    Accept: application/json, text/plain, */*

    Accept-Language: en-US,en;q=0.5

    Accept-Encoding: gzip, deflate, br

    Content-Type: application/json

    Content-Length: 336

    Origin: http://localhost:3000

    DNT: 1

    Connection: keep-alive

    Referer: http://localhost:3000/

    Sec-Fetch-Dest: empty

    Sec-Fetch-Mode: cors

    Sec-Fetch-Site: same-site

    Sec-GPC: 1

```

I’m concatenating four routes together (which might be connected to the problem) but I have tried both wrapping individual routes in a cors directive

```auto
val routes = cors() {
    pathPrefix("api" / "posts") {
      get {
        path(Segment) { id =>
          val uuid = UUID.fromString(id)
          complete((postActor ? GetPostByID(uuid)).mapTo[Post])
        } ~
          pathEndOrSingleSlash {
            complete((postActor ? GetAllPosts).mapTo[List[Post]])
          }
      } ~
        post {
          entity(as[Post]) { post =>
            complete((postActor ? CreatePost(post)).map(_ => StatusCodes.Created))
          }
        } ~
        put {
          path(Segment) { id =>
            val uuid = UUID.fromString(id)
            entity(as[Post]) { post =>
              complete((postActor ? UpdatePost(uuid, post)).map(_ => StatusCodes.OK))
            }
          }
        } ~
        delete {
          path(Segment) { id =>
            val uuid = UUID.fromString(id)
            complete((postActor ? DeletePost(uuid)).map(_ => StatusCodes.OK))
          }
        }
    }
  }

```

And wrapping the concatenated routes in a cors directive

```auto
val routes = cors() {
    concat(categoryRoutes, userRoutes, topicRoutes, postRoutes)
}

```

My application.conf looks like this:

```auto
akka-http-cors {
  allowed-origins = "http://localhost:3000"
  allowed-methods = ["GET", "POST", "PUT", "DELETE"]
}

```

The full source code is available in [this repo](https://github.com/gerhynes/foram-rest-api/)

If anyone can suggest where I’ve gone wrong, I’d be very grateful.

---

<div class="post-metadata">

**Author:** ![pjfanning](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.akka.io/pjfanning/32/1782_2.png) [@pjfanning](https://discuss.akka.io/u/pjfanning)\
**Post date:** [March 15, 2022, 11:36pm UTC](https://discuss.akka.io/t/akka-http-cors-headers-not-being-set/9602/2 "2022-03-15T23:36:22Z")

</div>

Is it possible the 400 Bad Request issue means you are not passing through the cors directive on the server side? [akka-http-cors/CorsServer.scala at master · lomigmegard/akka-http-cors · GitHub](https://github.com/lomigmegard/akka-http-cors/blob/master/akka-http-cors-example/src/main/scala/ch/megard/akka/http/cors/scaladsl/CorsServer.scala) has an example where the handleError directive wraps the cors directive to ensure that even error responses get CORS headers in responses.

---

<div class="post-metadata">

**Author:** ![domdorn](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.akka.io/domdorn/32/184_2.png) [@domdorn](https://discuss.akka.io/u/domdorn)\
**Post date:** [March 16, 2022, 10:43am UTC](https://discuss.akka.io/t/akka-http-cors-headers-not-being-set/9602/3 "2022-03-16T10:43:35Z")

</div>

I’ve looked at your config and compared with mine… you have

```auto
akka-http-cors {
  allowed-origins = "http://localhost:3000"
  allowed-headers = "*"
  allowed-methods = ["GET", "POST", "PUT", "DELETE", "HEAD", "OPTIONS"]
}

```

while I have

```auto
akka-http-cors {
  allowed-origins = ["http://127.0.0.1:1234", "http://localhost:1234"]
  allowed-methods = ["GET", "POST", "PUT", "DELETE", "HEAD", "OPTIONS"]
  exposed-headers = ["X-Correlation-ID"]
}

```

what I can spot is that `allowed-origins` is a list in my code and a string in yours.

---

<div class="post-metadata">

**Author:** ![gerhynes](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.akka.io/gerhynes/32/2818_2.png) [@gerhynes](https://discuss.akka.io/u/gerhynes)\
**Post date:** [March 16, 2022, 12:37pm UTC](https://discuss.akka.io/t/akka-http-cors-headers-not-being-set/9602/4 "2022-03-16T12:37:32Z")

</div>

This might have been the problem.

I’ve now wrapped the concatenated routes in an error handler and the CORS directive so any error response should also receive the appropriate headers.