Same Origin Policy violated on localhost with falcon webserver
<p>I am running an elm frontend via elm-reactor on <code>localhost:8000</code>. It is supposed to load json files from a <strong>falcon backend</strong> running via gunicorn on <code>localhost:8010</code>. This fails.</p>

<p>The frontend is able to load static dummy files served by elm-reactor (<code>:8000</code>) but when I try to replace the dummies by the actual backend (<code>:8010</code>) it fails due to a missing header:</p>

<blockquote>
  <p>Cross-Origin Request Blocked: The Same Origin Policy disallows reading
  the remote resource at <a href="http://localhost:8010/api/sheets" rel="nofollow">http://localhost:8010/api/sheets</a>. (Reason: CORS
  header 'Access-Control-Allow-Origin' missing).</p>
</blockquote>

<p>The error message from the Firefox Inspector seems reasonably clear, but I'm at a loss how to fix that. I already installed a CORS middleware in falcon, but that didn't improve the situation at all.</p>

<pre><code>from falcon_cors import CORS
cors = CORS(allow_origins_list=['*'])
api = falcon.API(middleware=[cors.middleware])
</code></pre>

<p>I did also try to use the origins <code>'localhost:8000'</code> and <code>'localhost'</code> but neither works.</p>

<p>Any idea how to fix this?</p>

<p>It turns out that falcon_cors offers <code>allow_all_origins=True</code> as a parameter. This fixes my problem, but isn't a perfect solution.</p>

<p>When using POST requests as well <code>allow_all_methods=True</code> should be set as well.</p>

python web-services cross-domain elm falconframework