I've seen this pattern pop up in a couple of different teams. They have a server with a REST API and a frontend web project.

What commonly happens is the frontend developer finds their requests are being blocked by CORS, and they create a REST API for the frontend that just passes requests through to the main backend. This API eventually catches some business logic and turns into its own server, handling half of the backend responsibility separate from the true backend server.

How can this pattern be prevented? It feels wrong to spread business logic across two API projects and to have to run two APIs to use the frontend. Is there a proper way to make a "set-and-forget" CORS proxy for the frontend, without creating a dumping ground?

  • 1
    None of those teams considered correctly configuring the backend? – jonrsharpe Feb 6 at 22:31
  • "They have a server with a REST API" <- Is "they" someone else? I would have thought there ought to be a separate rest service hosted specifically for developers. That service would need to allow CORS for the development machines. I hope you're not using a live service for development! – Dan Rayson Feb 6 at 22:31
  • 1
    @Dagrooms Having read it twice, it's clear it's someone in a team at your place, seems I jumped the gun. I would think that it's the person who designed the rest service's job to set up CORS to allow the domains that your front-end developers are using. Once it goes live, obviously swap around your CORS config to allow live front-end servers. I can't imagine there's a real requirement that there needs to be a proxy service specifically for CORS... – Dan Rayson Feb 6 at 22:39
  • 1
    enable-cors.org ...? – Dan Rayson Feb 6 at 22:44
  • 1
    @Dagrooms I would say so... I still can't quite believe that there's a need for a CORS proxy service... In my limited experience setting up CORS it's always been a simple server-client relationship. I think the answer to your question is simply "There shouldn't be a cors proxy service in the first place." I would consider chalking it up to the front-end developers not communicating well with the back-end teams? A simple "Can this developer have access to the service please?" would probably solve it? – Dan Rayson Feb 6 at 22:51

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.