# Region Maps Custom Boundary CORS Error

**URL:** <https://discuss.elastic.co/t/region-maps-custom-boundary-cors-error/162844>\
**Category:** Kibana\
**Created:** [January 3, 2019, 4:21pm UTC](https://discuss.elastic.co/t/region-maps-custom-boundary-cors-error/162844 "2019-01-03T16:21:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![avocado](https://avatars.discourse-cdn.com/v4/letter/a/df705f/32.png) [@avocado](https://discuss.elastic.co/u/avocado)\
**Post date:** [January 3, 2019, 4:21pm UTC](https://discuss.elastic.co/t/region-maps-custom-boundary-cors-error/162844/1 "2019-01-03T16:21:05Z")

</div>

Following the directions here [Custom Region Maps in Kibana 6.0](https://www.elastic.co/blog/custom-region-maps-in-kibana-6-0) I'm trying to connect a static http server for a custom region boundary geojson file to connect with Kibana.

Using npm http-server at Ubuntu command line in the appropriate sub-directory I am unable to connect from Kibana due to the following CORS error

> Cannot download [http://localhost:8000/custom\_bdys.geojson](http://localhost:8000/custom_bdys.geojson) file. Please ensure the CORS configuration of the server permits requests from the Kibana application on this host.

I have tried running http-server using several different options at the command line without success. Some of the options I've tried include:

> http-server --cors='\*' -p 8000  
> http-server --cors=\* -p 8000  
> http-server --cors=Authorization -p 8000

Any suggestions on how to resolve this issue? Someone suggested Chrome browser might be an issue but I haven't tried to test this yet....

Thanks!

---

<div class="post-metadata">

**Author:** ![avocado](https://avatars.discourse-cdn.com/v4/letter/a/df705f/32.png) [@avocado](https://discuss.elastic.co/u/avocado)\
**Post date:** [January 3, 2019, 5:49pm UTC](https://discuss.elastic.co/t/region-maps-custom-boundary-cors-error/162844/3 "2019-01-03T17:49:22Z")

</div>

A brief update is that I have tested CORS from Kibana to my static http server and that appears to be working, but I still get the CORS error in the region maps  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/1/a11b9874ab8bfa29603435c214bf579f62a6e764.png)

> curl -H "Origin: [https://22.22.22.93:5601](https://22.22.22.93:5601)" -H "Access-Control-Request-Method: POST" -H "Access-Control-Request-Headers: X-Requested-With" -X OPTIONS --verbose [http://22.22.22.93:8000](http://22.22.22.93:8000)

> \* Rebuilt URL to: [http://22.22.22.93:8000/](http://22.22.22.93:8000/)  
> \* Trying 22.22.22.93...  
> \* TCP\_NODELAY set  
> \* Connected to 22.22.22.93 (22.22.22.93) port 8000 (#0)  
> OPTIONS / HTTP/1.1  
> \> Host: 22.22.22.93:8000  
> \> User-Agent: curl/7.55.1  
> \> Accept: _/_  
> \> Origin: [https://22.22.22.93:5601](https://22.22.22.93:5601)  
> \> Access-Control-Request-Method: POST  
> \> Access-Control-Request-Headers: X-Requested-With  
> \>  
> \< HTTP/1.1 204 No Content  
> \< Access-Control-Allow-Origin: \*  
> \< Access-Control-Allow-Headers: origin,x-requested-with,content-type,accept,range,\*  
> \< Access-Control-Allow-Methods: GET,HEAD,POST  
> \< Date: Thu, 03 Jan 2019 17:44:42 GMT  
> \< Connection: keep-alive  
> \<  
> \* Connection #0 to host 22.22.22.93 left intact

---

<div class="post-metadata">

**Author:** ![avocado](https://avatars.discourse-cdn.com/v4/letter/a/df705f/32.png) [@avocado](https://discuss.elastic.co/u/avocado)\
**Post date:** [January 3, 2019, 11:27pm UTC](https://discuss.elastic.co/t/region-maps-custom-boundary-cors-error/162844/4 "2019-01-03T23:27:05Z")

</div>

The issue was caused due to security mismatch between using SSL on Kibana host and and serving the custom layer \*geojson from a non-encrypted http server. In Chrome there is a tiny little red icon in the top right hand of the url bar  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/5/95c5f69bea183f568608dade14c63804c36ad51d.png)  
Click this to ignore the security exception

Then if you explore the DevTools Console you can get the root cause of the error

> Mixed Content: The page at '[https://22.22.22.93:5601/](https://22.22.22.93:5601/) [....omitted...] was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint '[http://22.22.22.93:8000/aus\_state.geojson](http://22.22.22.93:8000/aus_state.geojson)'. This content should also be served over HTTPS.

Note that you will also get a similar error in Chrome if you serve up the \*geojson from HTTPS with an unverified or self-signed certificate.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 31, 2019, 11:39pm UTC](https://discuss.elastic.co/t/region-maps-custom-boundary-cors-error/162844/5 "2019-01-31T23:39:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.