CORS policy doesn't match API documentation - browser clients from other origins are blocked #6

New issue

Closed

opened 2026-03-07 04:56:42 +00:00 by box464 · 0 comments

box464 commented

2026-03-07 04:56:42 +00:00

(Migrated from codeberg.org)

Hi! I am trying to utilize the public API (no token).

The API documentation (doc/api.md, line 746) states:

codeberg.org/tom79/Holos-Discover@d9e71c0f07/doc/api.md (L746)

But the actual implementation in src/server.ts (lines 53-59) restricts CORS to only the instance's own publicUrl in production:

codeberg.org/tom79/Holos-Discover@d9e71c0f07/src/server.ts (L52-59)

This means any browser-based client on a different origin gets a CORS error when trying to use the API, even though the docs say all origins are allowed.

Based on the documentation, browser requests from any origin should be accepted - making the API usable from third-party web apps and search galleries.

Suggested fix

Change the production origin to '*' to match the documented behavior, or update the docs to reflect the actual restriction.

Sample Code
This came to my attention because I have been working on a cross platform photo gallery site (client side code) for awhile now. It currently has adapters for Mastodon, Lemmy, PieFed, Vernissage, and Bluesky visible for end users.

Tonight I added my work for Holos, but after getting to a point I could try it, I was seeing CORS errors popping up.

Here's the gallery link:

https://gts.scoobysnack.net/gallery

Currently the only way to get the Holos adapter to initialize is with a query string parameter (no front end UI at this point)

https://home.scoobysnack.net/gallery/?adapter=holos&tag=photography

Which throws this in the console.

[Error] Origin https://home.scoobysnack.net is not allowed by Access-Control-Allow-Origin. Status code: 200
[Error] Fetch API cannot load https://discover.holos.social/api/v1/timeline/tag/photographys?contentType=image&limit=25 due to access control checks.

Thanks!

Hi! I am trying to utilize the public API (no token). The API documentation (doc/api.md, line 746) states: https://codeberg.org/tom79/Holos-Discover/src/commit/d9e71c0f07536718666592d965e889a1d7c9bdc9/doc/api.md?display=source#L746 But the actual implementation in src/server.ts (lines 53-59) restricts CORS to only the instance's own publicUrl in production: https://codeberg.org/tom79/Holos-Discover/src/commit/d9e71c0f07536718666592d965e889a1d7c9bdc9/src/server.ts#L52-59 This means any browser-based client on a different origin gets a CORS error when trying to use the API, even though the docs say all origins are allowed. Based on the documentation, browser requests from any origin should be accepted - making the API usable from third-party web apps and search galleries. **Suggested fix** Change the production origin to '*' to match the documented behavior, or update the docs to reflect the actual restriction. **Sample Code** This came to my attention because I have been working on a cross platform photo gallery site (client side code) for awhile now. It currently has adapters for Mastodon, Lemmy, PieFed, Vernissage, and Bluesky visible for end users. Tonight I added my work for Holos, but after getting to a point I could try it, I was seeing CORS errors popping up. Here's the gallery link: https://gts.scoobysnack.net/gallery Currently the only way to get the Holos adapter to initialize is with a query string parameter (no front end UI at this point) https://home.scoobysnack.net/gallery/?adapter=holos&tag=photography Which throws this in the console. ``` [Error] Origin https://home.scoobysnack.net is not allowed by Access-Control-Allow-Origin. Status code: 200 [Error] Fetch API cannot load https://discover.holos.social/api/v1/timeline/tag/photographys?contentType=image&limit=25 due to access control checks. ``` Thanks!