# \[Plugin visualization\] CORS policy error message with ElasticsearchJS

**URL:** <https://discuss.elastic.co/t/plugin-visualization-cors-policy-error-message-with-elasticsearchjs/167994>\
**Category:** Kibana\
**Created:** [February 12, 2019, 9:14am UTC](https://discuss.elastic.co/t/plugin-visualization-cors-policy-error-message-with-elasticsearchjs/167994 "2019-02-12T09:14:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bard0x](https://avatars.discourse-cdn.com/v4/letter/b/5fc32e/32.png) [@bard0x](https://discuss.elastic.co/u/bard0x)\
**Post date:** [February 12, 2019, 9:14am UTC](https://discuss.elastic.co/t/plugin-visualization-cors-policy-error-message-with-elasticsearchjs/167994/1 "2019-02-12T09:14:00Z")

</div>

Hi guys,  
I developed a kibana plugin visualization integrating elasticsearch-browser to comunicate with elasticsearch.  
When I configure elasticsearch-browser with an angularJS application, if I try to ping my ES instance, in the console of my browser appared this errore message:

Access to XMLHttpRequest at '[http://127.0.0.1:9200/](http://127.0.0.1:9200/)' from origin '[http://127.0.0.1:5601](http://127.0.0.1:5601/)' has been blocked by CORS policy: Request header field kbn-version is not allowed by Access-Control-Allow-Headers in preflight response

Why? How I do to resolve this problem?  
Thank's in advance for the replies!

---

<div class="post-metadata">

**Author:** ![bard0x](https://avatars.discourse-cdn.com/v4/letter/b/5fc32e/32.png) [@bard0x](https://discuss.elastic.co/u/bard0x)\
**Post date:** [February 12, 2019, 9:21am UTC](https://discuss.elastic.co/t/plugin-visualization-cors-policy-error-message-with-elasticsearchjs/167994/2 "2019-02-12T09:21:20Z")

</div>

I resolved adding this in elasticsearch.yml

```auto
http.cors.enabled : true
http.cors.allow-origin : "*"
http.cors.allow-methods : OPTIONS, HEAD, GET, POST, PUT, DELETE
http.cors.allow-headers: "kbn-version, Origin, X-Requested-With, Content-Type, Accept, Engaged-Auth-Token"

```

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 12, 2019, 9:21am UTC](https://discuss.elastic.co/t/plugin-visualization-cors-policy-error-message-with-elasticsearchjs/167994/3 "2019-03-12T09:21:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.