# Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’

**URL:** <https://discuss.elastic.co/t/response-to-preflight-request-doesn-t-pass-access-control-check-no-access-control-allow-origin/348244>\
**Category:** Elastic Observability\
**Created:** [November 29, 2023, 3:00pm UTC](https://discuss.elastic.co/t/response-to-preflight-request-doesn-t-pass-access-control-check-no-access-control-allow-origin/348244 "2023-11-29T15:00:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![alexander3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexander3/32/128214_2.png) [@alexander3](https://discuss.elastic.co/u/alexander3)\
**Post date:** [November 29, 2023, 3:00pm UTC](https://discuss.elastic.co/t/response-to-preflight-request-doesn-t-pass-access-control-check-no-access-control-allow-origin/348244/1 "2023-11-29T15:00:37Z")

</div>

Hi, I am in a process of learning how to use Elastic, Kibana and a simple create-react-app project with OpenTelemetry to monitor a react application. After setting up Elastic, Kibana and instrumenting OpenTelemetry I am running into an issue when trying to send data:

"Access to XMLHttpRequest at '[http://localhost:8200/](http://localhost:8200/)' from origin '[http://localhost:3000](http://localhost:3000)' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource."

I am using Elastic v7.15.0, Kibana v7.15.0, Elastic agent 7.15.0 and OpenTelemetry.

My CORS configuration in elasticsearch.yml is:  
http.cors.enabled: true  
http.cors.allow-origin: "/.\*/"  
http.cors.allow-credentials: true  
http.cors.allow-headers: "X-Requested-With,Content-Type,Content-Length,Authorization,x-proxy-user"

The OPTIONS request passes but POST fails.

 ![Screen Shot 2023-11-29 at 9.35.05 AM](https://us1.discourse-cdn.com/elastic/original/3X/0/4/04ffb0257fef993b90d97393688161ee3cbb8810.png)  
 ![Screen Shot 2023-11-29 at 9.34.54 AM](https://us1.discourse-cdn.com/elastic/original/3X/0/3/03dc699400c6ff70badbe6ed4e5e1faa9391097c.png)

Request:  
curl '[http://localhost:8200/](http://localhost:8200/)'   
-H 'sec-ch-ua: "Google Chrome";v="119", "Chromium";v="119", "Not?A\_Brand";v="24"'   
-H 'sec-ch-ua-mobile: ?0'   
-H 'authorization: Bearer test'   
-H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_15\_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36'   
-H 'Content-Type: application/json, application/x-www-form-urlencoded'   
-H 'Accept: application/json'   
-H 'Referer: [http://localhost:3000/](http://localhost:3000/)'   
-H 'sec-ch-ua-platform: "macOS"'   
--data-raw '{"resourceSpans":[{"resource":{"attributes":[{"key":"service.name","value":{"stringValue":"frontend-js"}},{"key":"telemetry.sdk.language","value":{"stringValue":"webjs"}},{"key":"telemetry.sdk.name","value":{"stringValue":"opentelemetry"}},{"key":"telemetry.sdk.version","value":{"stringValue":"1.18.1"}}],"droppedAttributesCount":0},"scopeSpans":[{"scope":{"name":"@opentelemetry/instrumentation-user-interaction","version":"0.33.2"},"spans":[{"traceId":"fd9cc65e70d1f4707021d5d6d0ad4d23","spanId":"efc994f38b519556","name":"click","kind":1,"startTimeUnixNano":"1701269706118000000","endTimeUnixNano":"1701269706118300000","attributes":[{"key":"event\_type","value":{"stringValue":"click"}},{"key":"target\_element","value":{"stringValue":"HEADER"}},{"key":"target\_xpath","value":{"stringValue":"//html/body/div/div/header"}},{"key":"http.url","value":{"stringValue":"[http://localhost:3000/"}}],"droppedAttributesCount":0,"events":[],"droppedEventsCount":0,"status":{"code":0},"links":[],"droppedLinksCount](http://localhost:3000/%22%7D%7D%5D,%22droppedAttributesCount%22:0,%22events%22:%5B%5D,%22droppedEventsCount%22:0,%22status%22:%7B%22code%22:0%7D,%22links%22:%5B%5D,%22droppedLinksCount)":0}]}]}]}'   
--compressed

Any suggestions of what might be the issue?

---

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [January 18, 2024, 11:25am UTC](https://discuss.elastic.co/t/response-to-preflight-request-doesn-t-pass-access-control-check-no-access-control-allow-origin/348244/2 "2024-01-18T11:25:34Z")

</div>

Hi,

it's possible that you have to add in elasticsearch.yml:

http.cors.allow-methods: OPTIONS, POST

[Set up CORS for Behavioral Analytics | Elasticsearch Guide [8.12] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/behavioral-analytics-cors.html)

Regards