flask redirect "XMLHttpRequest cannot load..." error localhost
<p>Running flask locally, trying to call:</p>

<pre><code>@app.route('/foo_route', methods=['POST'])
@cross_origin(origin='*')
def foo():
    return redirect("https://www.google.com/")
</code></pre>

<p>And I get the following error:</p>

<blockquote>
  <p>XMLHttpRequest cannot load <a href="https://www.google.com/" rel="nofollow">https://www.google.com/</a>. No
  'Access-Control-Allow-Origin' header is present on the requested
  resource. Origin '<a href="http://127.0.0.1:5000" rel="nofollow">http://127.0.0.1:5000</a>' is therefore not allowed
  access</p>
</blockquote>

<p>I tried to use CORS as such:</p>

<pre><code>app = Flask(__name__)
CORS(app)
</code></pre>

<p>along with the @cross_origin() on my route. What is going wrong here? I was reading this may be a chrome bug when running locally?
.</p>

<p>I was having this same problem too! It is not a Chrome bug, it is built into chrome for security. (Cross Origin Resource Sharing) is a header that has to be present in the apache <code>httpd.conf or apache.conf or .htaccess</code> configuration file. If you are on NGINX, you have to edit the <code>defaults.conf or nginx.conf file</code> It basically makes it so that the web server accepts HTTP requests from places other than its own domain. The "real" way to fix it is by actually going into the web server (via ssh) and editing the applicable .conf to include this header. If you are on apache, you would add <code>Header set Access-Control-Allow-Origin "*"</code> at the top of the file. After you do this, restart apache in order to make sure that your changes are saved (<code>service httpd restart</code>). If you are on NGINX use this configuration:</p>

<pre><code>   #
# Wide-open CORS config for nginx
#
location / {
     if ($request_method = 'OPTIONS') {
        add_header 'Access-Control-Allow-Origin' '*';
        #
        # Om nom nom cookies
        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
        #
        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
     }
     if ($request_method = 'POST') {
        add_header 'Access-Control-Allow-Origin' '*';
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
     }
     if ($request_method = 'GET') {
        add_header 'Access-Control-Allow-Origin' '*';
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
     }
}
</code></pre>

<p>Now, I imagine, given your example, that you don't have access to the web server (since you put google's url in the URL). This is where it gets tricky. </p>

<p>One of your options is to use <a href="http://www.whateverorigin.org/" rel="nofollow">http://www.whateverorigin.org/</a>. It bypasses CORS and retrieves the data effectively. In order to use it, you would run:</p>

<pre><code>$.getJSON('http://whateverorigin.org/get?url=' + encodeURIComponent('http://google.com') + '&amp;callback=?', function(data){
    alert(data.contents);
});
</code></pre>

<p>This retrieves the response regardless of the CORS present on the web server. </p>

<p>If you don't want to change any of your existing code and you are using Google Chrome, there is a way around this CORS issue. One thing that you can do is install this browser extension: <a href="https://chrome.google.com/webstore/detail/allow-control-allow-origi/nlfbmbojpeacfghkpbjhddihlkkiljbi?utm_source=plus" rel="nofollow">https://chrome.google.com/webstore/detail/allow-control-allow-origi/nlfbmbojpeacfghkpbjhddihlkkiljbi?utm_source=plus</a>
and you can bypass CORS and run your program. </p>

<p>Hope this works for you!</p>

python flask flask-cors