# RUM: CORS Missing Allowed Origin **URL:** \ **Category:** APM\ **Tags:** rum, server\ **Created:** [July 21, 2022, 5:03am UTC](https://discuss.elastic.co/t/rum-cors-missing-allowed-origin/310231 "2022-07-21T05:03:33Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![WorldDrknss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/worlddrknss/32/108609_2.png) [@WorldDrknss](https://discuss.elastic.co/u/WorldDrknss)\ **Post date:** [July 21, 2022, 5:03am UTC](https://discuss.elastic.co/t/rum-cors-missing-allowed-origin/310231/1 "2022-07-21T05:03:33Z")
I've search high and low trying to get this issue figured out. I am currently having CORS issues regarding POST via the RUM agent, but preflight OPTIONS passes. APM server is deployed using Fleet. Bind is set to 0.0.0.0:8200 All my COR policies are set to wildcards, so therefore they should not be blocked. I am receiving a 403 response. Here is a screenshot of my network tab: ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/2/0270fbb0a06a06ba2b5247f4198bc60a85b85693.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/7/77624c917f372f8a2bad5f7337d8f6ccc81c012f.png) ---
**Author:** ![Alberto\_Delgado](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alberto_delgado/32/98488_2.png) [@Alberto\_Delgado](https://discuss.elastic.co/u/Alberto_Delgado)\ **Post date:** [July 21, 2022, 4:04pm UTC](https://discuss.elastic.co/t/rum-cors-missing-allowed-origin/310231/2 "2022-07-21T16:04:16Z")
Hi @WorldDrknss, Thanks for reaching out! It seems that the the CORS error is not related to your APM configuration. It seems that the **POST** request is being blocked by a firewall or something else. And since the response doesn't contain the allow-origin header the browser complains. "Request Forbidden by administrative rules" is not coming from APM servers -- I have a few questions: Do you know if there is proxy/firewall configured in your network? Do you know if your proxy server handling APM events have any kind of security policy? Have you tested in Firefox/Safari? I'm saying that because in Chromium browsers the payload is compressed with gzip. That might require changes in your firewall/proxy policies. There is an additional way to check if the compression is the reason behind the issue. From version [5.11.1](https://www.elastic.co/guide/en/apm/agent/rum-js/master/release-notes-5.x.html#release-notes-5.11.1) if you load your webpage adding the query parameter **_elastic\_inspect\_beacon_=true** to your url the compression will be disabled for that browser tab Another thing you can try to do is to clear the cache of your browser. Edit: I just tested your website (chrome and firefox) and it works properly: ![52ff3921d7f5d0de4d0074cc839c0f830bd5cc08](https://us1.discourse-cdn.com/elastic/original/3X/6/d/6d413fd0802527d3eee7b6b044b7288c4dec62a7.png) Let me know if this helps you Thanks, Alberto ---
**Author:** ![WorldDrknss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/worlddrknss/32/108609_2.png) [@WorldDrknss](https://discuss.elastic.co/u/WorldDrknss)\ **Post date:** [July 21, 2022, 4:19pm UTC](https://discuss.elastic.co/t/rum-cors-missing-allowed-origin/310231/3 "2022-07-21T16:19:24Z")
Alberto, Thanks I was finally able to figure out what was blocking the request. It turned out application/x-ndjson was not allowed through our WAF. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 11, 2022, 12:20pm UTC](https://discuss.elastic.co/t/rum-cors-missing-allowed-origin/310231/4 "2022-08-11T12:20:08Z")
This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.