# CORS header ‘Access-Control-Allow-Origin’ missing **URL:** \ **Category:** Radiology\ **Tags:** gsoc2018\ **Created:** [April 20, 2018, 6:02am UTC](https://forums.librehealth.io/t/cors-header-access-control-allow-origin-missing/2321 "2018-04-20T06:02:54Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![lehone](https://forums.librehealth.io/user_avatar/forums.librehealth.io/lehone/32/352_2.png) [@lehone](https://forums.librehealth.io/u/lehone)\ **Post date:** [April 20, 2018, 6:02am UTC](https://forums.librehealth.io/t/cors-header-access-control-allow-origin-missing/2321/1 "2018-04-20T06:02:55Z")
I am trying to GET Radiology Reports via REST from my angular application but I keep getting this error _Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at [https://radiology.librehealth.io/lh-toolkit/ws/rest/v1/radiologyreport/?status=&v=full](https://radiology.librehealth.io/lh-toolkit/ws/rest/v1/radiologyreport/?status=&v=full). (Reason: CORS header ‘Access-Control-Allow-Origin’ missing)._ Please how can resolve this? I am trying to complete [https://gitlab.com/librehealth/lh-radiology/issues/42](https://gitlab.com/librehealth/lh-radiology/issues/42) ---
**Author:** ![ivange94](https://forums.librehealth.io/user_avatar/forums.librehealth.io/ivange94/32/1031_2.png) [@ivange94](https://forums.librehealth.io/u/ivange94)\ **Post date:** [April 20, 2018, 9:03am UTC](https://forums.librehealth.io/t/cors-header-access-control-allow-origin-missing/2321/2 "2018-04-20T09:03:58Z")
> [@lehone](#): > > [Upload report PDF to orthanc (#42) · Issues · LibreHealth / LibreHealth Radiology / lh-radiology · GitLab](https://gitlab.com/librehealth/lh-radiology/issues/42) You will get that if your angular app is a standalone app that is trying to to make REST calls to a server running on another domain. I see you are trying to access the hosted API. I will advice you setup your own radiology server and make REST calls to that server. Isn’t this supposed to be an owa? Why does it seem like it’s a standalone web app? ---
**Author:** ![ivange94](https://forums.librehealth.io/user_avatar/forums.librehealth.io/ivange94/32/1031_2.png) [@ivange94](https://forums.librehealth.io/u/ivange94)\ **Post date:** [April 20, 2018, 9:07am UTC](https://forums.librehealth.io/t/cors-header-access-control-allow-origin-missing/2321/3 "2018-04-20T09:07:41Z")
Toolkit does not support CORS. So by default services out of the domain cannot access it’s API. I think there is a way to enable that from tomcat but that is by the way. In the first place you shouldn’t be having that error if you are building an owa and you have a local server setup. Your code should make REST calls to the server in which the owa is running not a remote server. If that is an owa and you have a local radiology server running trying making the REST call to ``` /lh-toolkit/ws/rest/v1/radiologyreport/?status=&v=full ``` You don’t need to include the host and the domain. That will default to which ever domain the app is hosted on which will be the radiology/toolkit server the app is running on. ---
**Author:** ![lehone](https://forums.librehealth.io/user_avatar/forums.librehealth.io/lehone/32/352_2.png) [@lehone](https://forums.librehealth.io/u/lehone)\ **Post date:** [April 20, 2018, 10:32am UTC](https://forums.librehealth.io/t/cors-header-access-control-allow-origin-missing/2321/4 "2018-04-20T10:32:44Z")
Yeah, it is suppose to be an OWA but I need to be testing as I am building so it becomes tedious if I have to upload the OWA each time I make changes. ---
**Author:** ![ivange94](https://forums.librehealth.io/user_avatar/forums.librehealth.io/ivange94/32/1031_2.png) [@ivange94](https://forums.librehealth.io/u/ivange94)\ **Post date:** [April 20, 2018, 11:05am UTC](https://forums.librehealth.io/t/cors-header-access-control-allow-origin-missing/2321/5 "2018-04-20T11:05:43Z")
Then you may need to enable cross origin from tomcat or toolkit. ---
**Author:** ![sunbiz](https://forums.librehealth.io/user_avatar/forums.librehealth.io/sunbiz/32/395_2.png) [@sunbiz](https://forums.librehealth.io/u/sunbiz)\ **Post date:** [April 20, 2018, 11:50am UTC](https://forums.librehealth.io/t/cors-header-access-control-allow-origin-missing/2321/6 "2018-04-20T11:50:02Z")
Making tomcat/nginx start with CORS headers might be more work. The easiest and fastest way that I use is to close all instances of Chrome. And then start it with --user-dir --disable-web-security flags. Then it allows for cross-origin calls. ---
**Author:** ![ivange94](https://forums.librehealth.io/user_avatar/forums.librehealth.io/ivange94/32/1031_2.png) [@ivange94](https://forums.librehealth.io/u/ivange94)\ **Post date:** [April 20, 2018, 12:42pm UTC](https://forums.librehealth.io/t/cors-header-access-control-allow-origin-missing/2321/7 "2018-04-20T12:42:29Z")
@sunbiz I wish I knew that last year during GSoC 😂 ---
**Author:** ![r0bby](https://forums.librehealth.io/user_avatar/forums.librehealth.io/r0bby/32/1781_2.png) [@r0bby](https://forums.librehealth.io/u/r0bby)\ **Post date:** [April 20, 2018, 8:44pm UTC](https://forums.librehealth.io/t/cors-header-access-control-allow-origin-missing/2321/12 "2018-04-20T20:44:21Z")
I will look into this later. why are you making HEAD requests @lehone? GET, PUT, POST, PATCH, DELETE and OPTIONS works. ---
**Author:** ![r0bby](https://forums.librehealth.io/user_avatar/forums.librehealth.io/r0bby/32/1781_2.png) [@r0bby](https://forums.librehealth.io/u/r0bby)\ **Post date:** [April 20, 2018, 8:59pm UTC](https://forums.librehealth.io/t/cors-header-access-control-allow-origin-missing/2321/13 "2018-04-20T20:59:32Z")
I just tested against toolkit and radiology – I made config changes and tested with [the Polymer Login component](https://github.com/parumenon1/lhtoolkit-core/) and it worked. ---
**Author:** ![r0bby](https://forums.librehealth.io/user_avatar/forums.librehealth.io/r0bby/32/1781_2.png) [@r0bby](https://forums.librehealth.io/u/r0bby)\ **Post date:** [April 20, 2018, 11:35pm UTC](https://forums.librehealth.io/t/cors-header-access-control-allow-origin-missing/2321/14 "2018-04-20T23:35:08Z")
As a note - if you ever need to inspect what headers are being received, `curl -I` is how you do it. CORS support for HEAD requests isn’t necessary. ---
**Author:** ![sunbiz](https://forums.librehealth.io/user_avatar/forums.librehealth.io/sunbiz/32/395_2.png) [@sunbiz](https://forums.librehealth.io/u/sunbiz)\ **Post date:** [April 21, 2018, 12:17am UTC](https://forums.librehealth.io/t/cors-header-access-control-allow-origin-missing/2321/15 "2018-04-21T00:17:48Z")
In the recent years, I am now of the opinion that demo servers are the only deployments where we should use these headers. In real implementations, one should never add those headers even on VPN connections. This is only an intermediate problem for the next couple of months, where we will move to OAuth for FHIR OWAs during the summer. ---
**Author:** ![r0bby](https://forums.librehealth.io/user_avatar/forums.librehealth.io/r0bby/32/1781_2.png) [@r0bby](https://forums.librehealth.io/u/r0bby)\ **Post date:** [April 21, 2018, 1:30am UTC](https://forums.librehealth.io/t/cors-header-access-control-allow-origin-missing/2321/16 "2018-04-21T01:30:07Z")
> [@sunbiz](#): > > In the recent years, I am now of the opinion that demo servers are the only deployments where we should use these headers. In real implementations, one should never add those headers even on VPN connections. > > This is only an intermediate problem for the next couple of months, where we will move to OAuth for FHIR OWAs during the summer. eh – in some cases - CORS is necessary. For our use, not so much. ---
**Author:** ![r0bby](https://forums.librehealth.io/user_avatar/forums.librehealth.io/r0bby/32/1781_2.png) [@r0bby](https://forums.librehealth.io/u/r0bby)\ **Post date:** [January 6, 2021, 6:45am UTC](https://forums.librehealth.io/t/cors-header-access-control-allow-origin-missing/2321/17 "2021-01-06T06:45:42Z")