# \[elastic/app-search-node\] Cannot destroy documents due to CORS issue

**URL:** <https://discuss.elastic.co/t/elastic-app-search-node-cannot-destroy-documents-due-to-cors-issue/235879>\
**Category:** Elastic Search\
**Tags:** elastic-app-search\
**Created:** [June 5, 2020, 2:39am UTC](https://discuss.elastic.co/t/elastic-app-search-node-cannot-destroy-documents-due-to-cors-issue/235879 "2020-06-05T02:39:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![terell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/terell/32/69755_2.png) [@terell](https://discuss.elastic.co/u/terell)\
**Post date:** [June 5, 2020, 2:39am UTC](https://discuss.elastic.co/t/elastic-app-search-node-cannot-destroy-documents-due-to-cors-issue/235879/1 "2020-06-05T02:39:30Z")

</div>

Hi, I'm using the app-search node js client library in my web application. I'm able to index, and search for documents but when I try to destroy them I receive the following error:

`Access to fetch at '{redacted}/documents' from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.`

Any idea how to fix this?

---

<div class="post-metadata">

**Author:** ![JasonStoltz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jasonstoltz/32/49893_2.png) [@JasonStoltz](https://discuss.elastic.co/u/JasonStoltz)\
**Post date:** [June 5, 2020, 11:00am UTC](https://discuss.elastic.co/t/elastic-app-search-node-cannot-destroy-documents-due-to-cors-issue/235879/2 "2020-06-05T11:00:33Z")

</div>

Hey @terell, the correct way to hit the index or delete endpoints from a browser is to set up your own server side endpoints which then call index or delete. This will solve your CORS issue, and also alleviate 2 other issues:

1. You should probably not be using the App Search node client in browser based JavaScript. We have a JavaScript client which is intended for browser usage: [https://github.com/elastic/app-search-javascript](https://github.com/elastic/app-search-javascript).

2. The index and delete endpoints require a [Private Key](https://www.elastic.co/guide/en/app-search/current/authentication.html#authentication-key-types), which you would not want to expose in browser JavaScript. The only key which is considered safe to expose is the Search Key.

Hope this helps,

Jason

---

<div class="post-metadata">

**Author:** ![terell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/terell/32/69755_2.png) [@terell](https://discuss.elastic.co/u/terell)\
**Post date:** [June 8, 2020, 6:30pm UTC](https://discuss.elastic.co/t/elastic-app-search-node-cannot-destroy-documents-due-to-cors-issue/235879/3 "2020-06-08T18:30:59Z")

</div>

Thanks @JasonStoltz! That worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2020, 6:31pm UTC](https://discuss.elastic.co/t/elastic-app-search-node-cannot-destroy-documents-due-to-cors-issue/235879/4 "2020-07-06T18:31:06Z")

</div>

Closed on July 6, 2020, 6:31pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.