# How to disable the CORS? **URL:** \ **Category:** Flowable Engine\ **Created:** [May 18, 2018, 5:36pm UTC](https://forum.flowable.org/t/how-to-disable-the-cors/2037 "2018-05-18T17:36:10Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![MauF](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/mauf/32/679_2.png) [@MauF](https://forum.flowable.org/u/MauF)\ **Post date:** [May 18, 2018, 5:36pm UTC](https://forum.flowable.org/t/how-to-disable-the-cors/2037/1 "2018-05-18T17:36:10Z")
Hello, I’m trying to invoke the rest api from a custom web-app (the web-app is hosted in another server). I start the flowable environment from docker using the following docker-compose.yml version: ‘3.6’ services: flowable-rest-app: image: flowable/flowable-rest depends\_on: - flowable-db environment: - SERVER\_PORT=9977 - SPRING\_DATASOURCE\_DRIVER-CLASS-NAME=org.postgresql.Driver - SPRING\_DATASOURCE\_URL=jdbc:postgresql://flowable-db:5432/flowable - SPRING\_DATASOURCE\_USERNAME=flowable - SPRING\_DATASOURCE\_PASSWORD=flowable - FLOWABLE.REST.APP.ADMIN.USER-ID=rest-admin - FLOWABLE.REST.APP.ADMIN.PASSWORD=test - FLOWABLE.REST.APP.ADMIN.FIRST-NAME=Rest - FLOWABLE.REST.APP.ADMIN.LAST-NAME=Admin ports: - 9977:9977 depends\_on: - flowable-db flowable-modeler-app: image: flowable/flowable-modeler container\_name: flowable-modeler depends\_on: - flowable-db - flowable-idm-app - flowable-task-app environment: - SERVER\_PORT=8888 - SPRING\_DATASOURCE\_DRIVER-CLASS-NAME=org.postgresql.Driver - SPRING\_DATASOURCE\_URL=jdbc:postgresql://flowable-db:5432/flowable - SPRING\_DATASOURCE\_USERNAME=flowable - SPRING\_DATASOURCE\_PASSWORD=flowable - FLOWABLE\_COMMON\_APP\_IDM-URL=http://flowable-idm-app:8080/flowable-idm - FLOWABLE\_COMMON\_APP\_IDM-REDIRECT-URL=http://localhost:8080/flowable-idm - FLOWABLE\_COMMON\_APP\_IDM-ADMIN.USER=admin - FLOWABLE\_COMMON\_APP\_IDM-ADMIN.PASSWORD=test - FLOWABLE\_MODELER\_APP\_DEPLOYMENT-API-URL=http://flowable-task-app:9999/flowable-task/process-api ports: - 8888:8888 flowable-task-app: image: flowable/flowable-task container\_name: flowable-task depends\_on: - flowable-db - flowable-idm-app environment: - SERVER\_PORT=9999 - SPRING\_DATASOURCE\_DRIVER-CLASS-NAME=org.postgresql.Driver - SPRING\_DATASOURCE\_URL=jdbc:postgresql://flowable-db:5432/flowable - SPRING\_DATASOURCE\_USERNAME=flowable - SPRING\_DATASOURCE\_PASSWORD=flowable - FLOWABLE\_COMMON\_APP\_IDM-URL=http://flowable-idm-app:8080/flowable-idm - FLOWABLE\_COMMON\_APP\_IDM-REDIRECT-URL=http://localhost:8080/flowable-idm - FLOWABLE\_COMMON\_APP\_IDM-ADMIN.USER=admin - FLOWABLE\_COMMON\_APP\_IDM-ADMIN.PASSWORD=test ports: - 9999:9999 flowable-idm-app: image: flowable/flowable-idm container\_name: flowable-idm depends\_on: - flowable-db environment: - SERVER\_PORT=8080 - SPRING\_DATASOURCE\_DRIVER-CLASS-NAME=org.postgresql.Driver - SPRING\_DATASOURCE\_URL=jdbc:postgresql://flowable-db:5432/flowable - SPRING\_DATASOURCE\_USERNAME=flowable - SPRING\_DATASOURCE\_PASSWORD=flowable ports: - 8080:8080 flowable-admin-app: image: flowable/flowable-admin container\_name: flowable-admin depends\_on: - flowable-db - flowable-idm-app - flowable-task-app environment: - SERVER\_PORT=9988 - SPRING\_DATASOURCE\_DRIVER-CLASS-NAME=org.postgresql.Driver - SPRING\_DATASOURCE\_URL=jdbc:postgresql://flowable-db:5432/flowable - SPRING\_DATASOURCE\_USERNAME=flowable - SPRING\_DATASOURCE\_PASSWORD=flowable - FLOWABLE\_COMMON\_APP\_IDM-URL=http://flowable-idm-app:8080/flowable-idm - FLOWABLE\_COMMON\_APP\_IDM-REDIRECT-URL=http://localhost:8080/flowable-idm - FLOWABLE\_COMMON\_APP\_IDM-ADMIN.USER=admin - FLOWABLE\_COMMON\_APP\_IDM-ADMIN.PASSWORD=test - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_PROCESS\_SERVER-ADDRESS=http://flowable-task-app - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_PROCESS\_PORT=9999 - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_PROCESS\_CONTEXT-ROOT=flowable-task - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_PROCESS\_REST-ROOT=process-api - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_CMMN\_SERVER-ADDRESS=http://flowable-task-app - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_CMMN\_PORT=9999 - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_CMMN\_CONTEXT-ROOT=flowable-task - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_CMMN\_REST-ROOT=cmmn-api - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_DMN\_SERVER-ADDRESS=http://flowable-task-app - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_DMN\_PORT=9999 - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_DMN\_CONTEXT-ROOT=flowable-task - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_DMN\_REST-ROOT=dmn-api - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_FORM\_SERVER-ADDRESS=http://flowable-task-app - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_FORM\_PORT=9999 - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_FORM\_CONTEXT-ROOT=flowable-task - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_FORM\_REST-ROOT=form-api - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_CONTENT\_SERVER-ADDRESS=http://flowable-task-app - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_CONTENT\_PORT=9999 - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_CONTENT\_CONTEXT-ROOT=flowable-task - FLOWABLE\_ADMIN\_APP\_SERVER-CONFIG\_CONTENT\_REST-ROOT=content-api ports: - 9988:9988 flowable-db: image: postgres:9.6-alpine container\_name: flowable-postgres environment: - POSTGRES\_PASSWORD=flowable - POSTGRES\_USER=flowable - POSTGRES\_DB=flowable ports: - 5433:5432 command: postgres Now if I try to call this call [http://localhost:8080/flowable-idm/app/authentication](http://localhost:8080/flowable-idm/app/authentication) Method: POST Content-Type: application/x-www-form-urlencoded" payload: “j\_username=admin&j\_password=test&\_spring\_security\_remember\_me=true&submit=Login” I have the CORS error. Do you know if there is a way to launch the docker containers with some parameters to disable the CORS for development sake? Thanks, Maurizio ---
**Author:** ![aronim](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/aronim/32/327_2.png) [@aronim](https://forum.flowable.org/u/aronim)\ **Post date:** [May 20, 2018, 9:40pm UTC](https://forum.flowable.org/t/how-to-disable-the-cors/2037/2 "2018-05-20T21:40:43Z")
Hi Maurizio, I had a look at the CORS issue, and what I found so far is that it is actually a Spring WebMVC issue. They have a class called DefaultCorsProcessor which is called from AbstractHandlerMapping, that does a Cors check on all preflight requests (ie. OPTIONS) and fails requests that do not contain a “Access-Control-Allow-Origin: \*” in the header. Unfortunately, I don’t see an easy way to disable this feature. Kevin ---
**Author:** ![MauF](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/mauf/32/679_2.png) [@MauF](https://forum.flowable.org/u/MauF)\ **Post date:** [May 21, 2018, 1:48pm UTC](https://forum.flowable.org/t/how-to-disable-the-cors/2037/3 "2018-05-21T13:48:02Z")
Hi Kevin, thank you for the info. I will try do embed the engine and I will try expose the stuff that I need. Maurizio ---
**Author:** ![aronim](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/aronim/32/327_2.png) [@aronim](https://forum.flowable.org/u/aronim)\ **Post date:** [May 21, 2018, 6:34pm UTC](https://forum.flowable.org/t/how-to-disable-the-cors/2037/4 "2018-05-21T18:34:56Z")
Out of curiosity, what is the desired deployment you are trying to achieve? What is technology stack for the UI you are trying to call from? ---
**Author:** ![filiphr](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/filiphr/32/315_2.png) [@filiphr](https://forum.flowable.org/u/filiphr)\ **Post date:** [May 22, 2018, 6:00am UTC](https://forum.flowable.org/t/how-to-disable-the-cors/2037/5 "2018-05-22T06:00:22Z")
You can also trying to create your own application by depending on the `flowable-spring-boot-starter-rest` which is more or less what the `flowable-rest` app does. If you do this then you can define your own security and disable CORS (have a look [here](https://stackoverflow.com/questions/44697883/can-you-completely-disable-cors-support-in-spring)) ---
**Author:** ![MauF](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/mauf/32/679_2.png) [@MauF](https://forum.flowable.org/u/MauF)\ **Post date:** [May 22, 2018, 8:32am UTC](https://forum.flowable.org/t/how-to-disable-the-cors/2037/6 "2018-05-22T08:32:35Z")
We are trying to replace the camunda engine (on the “back-end”) and for the modeler we are going to replace a custom react js UI based on [bpmn.io](http://bpmn.io), using orxy. We are calling the rest API thought a simple fetch call, something like this: const url = “[http://localhost:8080/flowable-idm/app/authentication](http://localhost:8080/flowable-idm/app/authentication)”; let form = … fetch(url, { method: “POST”, body: form.join(’&’), headers: { ‘Content-Type’: ‘application/x-www-form-urlencoded’ } }).then(response =\> {…}); ---
**Author:** ![MauF](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/mauf/32/679_2.png) [@MauF](https://forum.flowable.org/u/MauF)\ **Post date:** [May 22, 2018, 8:33am UTC](https://forum.flowable.org/t/how-to-disable-the-cors/2037/7 "2018-05-22T08:33:15Z")
> You can also trying to create your own application by depending on the flowable-spring-boot-starter-rest which is more or less what the flowable-rest app does. If you do this then you can define your own security and disable CORS (have a look here) Thank you! I will try! Maurizio ---
**Author:** ![aronim](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/aronim/32/327_2.png) [@aronim](https://forum.flowable.org/u/aronim)\ **Post date:** [May 23, 2018, 12:52am UTC](https://forum.flowable.org/t/how-to-disable-the-cors/2037/8 "2018-05-23T00:52:03Z")
Is there not a possibility of putting the Flowable UIs and your own application behind the same domain? ie. putting Apache HTTP Server in front of both with ReverseProxy configuration. ---
**Author:** ![srinathganesh](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/srinathganesh/32/2392_2.png) [@srinathganesh](https://forum.flowable.org/u/srinathganesh)\ **Post date:** [April 27, 2019, 11:50am UTC](https://forum.flowable.org/t/how-to-disable-the-cors/2037/9 "2019-04-27T11:50:02Z")
we put a nginx reverse proxy with `proxy_hide_header X-Frame-Options;` to solve it ---
**Author:** ![christine](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/christine/32/1132_2.png) [@christine](https://forum.flowable.org/u/christine)\ **Post date:** [April 30, 2019, 2:38pm UTC](https://forum.flowable.org/t/how-to-disable-the-cors/2037/10 "2019-04-30T14:38:10Z")
Why would you want to disable CORS, rather than configure it properly? Spring boot has good support for CORS. ---
**Author:** ![srinathganesh](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/srinathganesh/32/2392_2.png) [@srinathganesh](https://forum.flowable.org/u/srinathganesh)\ **Post date:** [May 13, 2019, 9:58am UTC](https://forum.flowable.org/t/how-to-disable-the-cors/2037/11 "2019-05-13T09:58:09Z")
like if you want to deploy via Docker (not change the Spring code), is there a way? ---
**Author:** ![danielp.michalski](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/danielp.michalski/32/2817_2.png) [@danielp.michalski](https://forum.flowable.org/u/danielp.michalski)\ **Post date:** [May 10, 2022, 4:13pm UTC](https://forum.flowable.org/t/how-to-disable-the-cors/2037/12 "2022-05-10T16:13:41Z")
For interested folks - how `flowable-rest` app allows configuring CORS: [Spring Boot · Flowable Open Source Documentation](https://www.flowable.com/open-source/docs/bpmn/ch05a-Spring-Boot#flowable-application-properties)