Skip to content

Configure cross-origin access

Configure CORS when browser scripts call an API or read result objects from an origin different from the UI. An origin is the scheme, hostname, and optional port, not a page URL. API CORS and bucket CORS are independent settings.

Use HTTPS endpoints when AntFlow is served over HTTPS to avoid browser mixed-content blocking. For public endpoint and TLS configuration, follow Expose AntFlow over HTTPS.

The configuration blocks below are templates. Replace https://antflow.example.com with the actual UI origin, or http://localhost:8080 for port-forward access.

API CORS

If the UI and API use different origins, allow the UI origin in the API's CORS configuration. Set configs.allowed_origins through Helm:

configs:
  allowed_origins:
    - https://antflow.example.com

With an empty list, the chart defaults to the public HTTPS domain when server exposure is enabled, or http://localhost:8080 for local port-forward access. If the UI uses a different hostname from the API, set its origin explicitly.

Bucket CORS

For result reads redirected to object storage, the browser must reach the S3 endpoint directly. When browser scripts read those objects, configure bucket CORS for the UI origin. To determine which reads are redirected or proxied, see Result delivery.

For an S3-compatible service supporting the AWS bucket CORS format:

{
  "CORSRules": [
    {
      "AllowedMethods": ["GET", "HEAD"],
      "AllowedOrigins": ["https://antflow.example.com"],
      "AllowedHeaders": ["*"],
      "ExposeHeaders": ["ETag"],
      "MaxAgeSeconds": 3600
    }
  ]
}

Apply this policy to the result bucket using your storage provider's management tools. Do not allow the null origin unless you deliberately support clients with an opaque origin. CORS does not grant object permissions or make the bucket public.

Check a browser access failure

Check the failing request in the browser's network tools before changing a policy:

  • For an API request, check the UI origin against configs.allowed_origins.
  • For a redirected result read, check storage reachability and the bucket's CORS policy.
  • For a proxied result read, check API access and server-to-storage connectivity; bucket CORS is not required for that browser read.
  • For a browser certificate error, check the HTTPS endpoint's certificate and trust chain against the HTTPS prerequisites.

Use Service connectivity to check which component must reach each endpoint. Changing CORS does not repair unreachable services or untrusted certificates.