# \[ES 5.0\] PUT/POST are forbidden if enable CORS

**URL:** <https://discuss.elastic.co/t/es-5-0-put-post-are-forbidden-if-enable-cors/67996>\
**Category:** Elasticsearch\
**Created:** [December 5, 2016, 8:12am UTC](https://discuss.elastic.co/t/es-5-0-put-post-are-forbidden-if-enable-cors/67996 "2016-12-05T08:12:18Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Youxu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/youxu/32/117375_2.png) [@Youxu](https://discuss.elastic.co/u/Youxu)\
**Post date:** [December 5, 2016, 8:12am UTC](https://discuss.elastic.co/t/es-5-0-put-post-are-forbidden-if-enable-cors/67996/1 "2016-12-05T08:12:18Z")

</div>

I set up an ES 5.0 cluster. To allow HEAD to access ES cluster, I enabled the CORS with following configs:

http.cors.enabled: true  
http.cors.allow-origin: /https?://.+?(:[0-9]+)?/

After cors is enabled, all GET method work fine, but POST and PUT always failed with 403 - forbidden error.

What I missed?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [December 5, 2016, 9:43am UTC](https://discuss.elastic.co/t/es-5-0-put-post-are-forbidden-if-enable-cors/67996/2 "2016-12-05T09:43:49Z")

</div>

Hey,

do you have an example request that works and one that does not (so one can reproduce this using curl?), also there is a `http.cors.allow-methods`, that supports PUT and POST as well, but maybe it is overwritten?

Can you paste the output of `curl -v 'localhost:9200/_nodes/settings?filter_path=**.cors'`

--Alex

---

<div class="post-metadata">

**Author:** ![Youxu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/youxu/32/117375_2.png) [@Youxu](https://discuss.elastic.co/u/Youxu)\
**Post date:** [December 5, 2016, 2:52pm UTC](https://discuss.elastic.co/t/es-5-0-put-post-are-forbidden-if-enable-cors/67996/3 "2016-12-05T14:52:59Z")

</div>

I used ES 5.0.1

Here is the output of settings?filter\_path=\*\*.cors

{  
"nodes": {  
"moATbDqlR7iaZfoagXIoag": {  
"settings": {  
"http": {  
"cors": {  
"allow-origin": "/https?:\/\/.+?(:[0-9]+)?/",  
"enabled": "true"  
}  
}  
}  
}  
}  
}

Example request that work:  
GET [http://localhost:9200/\_search](http://localhost:9200/_search)

And example request not work  
PUT [http://localhost:9200/testindex](http://localhost:9200/testindex)  
{  
"mappings": {  
"docs": {  
"properties": {  
"title": {  
"type": "text"  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [December 5, 2016, 5:03pm UTC](https://discuss.elastic.co/t/es-5-0-put-post-are-forbidden-if-enable-cors/67996/4 "2016-12-05T17:03:10Z")

</div>

Hey,

Can you provide original requests including the headers, so we can reproduce them via curl and see what happens. Also the responses are not pasted here, so the error message cannot be seen.

Thanks!

--Alex

---

<div class="post-metadata">

**Author:** ![Youxu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/youxu/32/117375_2.png) [@Youxu](https://discuss.elastic.co/u/Youxu)\
**Post date:** [December 6, 2016, 1:36am UTC](https://discuss.elastic.co/t/es-5-0-put-post-are-forbidden-if-enable-cors/67996/5 "2016-12-06T01:36:06Z")

</div>

hi Alex  
I have identified the root cause why I got 403 forbidden error for all POST and PUT requests after trying repro using cURL.

It is because I used postman to send request to my cluster, and postman by default will always append the Origin header for POST and PUT request with following value:  
**chrome-extension://xxxxxx**

And it does not match the allowed origin setting in my elasticsearch.yml:  
**http.cors.allow-origin: /https?://.+?(:[0-9]+)?/**

So got 403 forbidden.

With cURL, I did not append any header in request, so worked as expected.

Thanks your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 3, 2017, 1:36am UTC](https://discuss.elastic.co/t/es-5-0-put-post-are-forbidden-if-enable-cors/67996/6 "2017-01-03T01:36:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.