CORS Error - Access-Control-Allow-Origin Header Missing

Nuki APIs Web
1

I hope this message finds you well. I am writing to seek assistance with a CORS (Cross-Origin Resource Sharing) error that I’m encountering while trying to access the Nuki API.

The specific error message I’m receiving is as follows: “Access to XMLHttpRequest at ‘https://api.nuki.io/oauth2/authorize?response_type=code&client_id=9zzsaRVrchVZ18E3lt1UVQ&redirect_uri=https://dev.memoriarigorosa.com/testes/&scope=smartlock:write%20smartlock:read%20smartlock:action:log%20smartlock:action:manage%20smartlock:auth%20smartlock:state:read’ from origin ‘https://dev.memoriarigorosa.com’ has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’ header is present on the requested resource.”

This error suggests that the ‘Access-Control-Allow-Origin’ header is not included in the response from the Nuki API, thereby preventing cross-origin requests from my domain ‘https://dev.memoriarigorosa.com’.

I have checked the API documentation, and it does not provide specific instructions or requirements regarding CORS. Therefore, I kindly request your assistance in resolving this issue. Could you please consider adding the necessary ‘Access-Control-Allow-Origin’ header to the API response or provide guidance on how to properly access the API from a different origin?

Thank you for your attention to this matter. I appreciate your support and look forward to hearing back from you.

3

Hi Sidonio,

We received your email and have requested for some clarifications in order to help you better. Will follow up on email further to resolve the issue.

4

Hi Poonam,
I have the same issue since last week. I have the API call with unlock functionality working for more than a year already. And now it suddenly does not word any more. I haven’t changed anything to my coding for months already. So that is not the issue.

I get the following error:
Access to XMLHttpRequest at ‘https://api.nuki.io/smartlock/9999999999/action/unlock’ from origin ‘https://app.xxxxxxxxxx.xx’ has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource.

Can you help me to resolve this issue.

Kind regards,
Harry

5

Hello,

The CORS configurations were changed on our servers on 04.03. to comply with stricter security requirements. The access to API endpoints form localhost is no longer supported.

One way to resolve this issue is through Proxying the Request
If you don’t have control over the server’s CORS configuration, you can proxy the request through your own server. Your server can make the request to ‘https://api.nuki.io’ on behalf of your web application. Since the request is coming from your server, CORS won’t be an issue.

1 Like