[Bug]: CORS issue

[meenal9]

Package.json file

{
  "name": "medusa-starter-default",
  "version": "0.0.1",
  "description": "A starter for Medusa projects.",
  "author": "Medusa (https://medusajs.com)",
  "license": "MIT",
  "keywords": [
    "sqlite",
    "postgres",
    "typescript",
    "ecommerce",
    "headless",
    "medusa"
  ],
  "scripts": {
    "build": "medusa build",
    "seed": "medusa exec ./src/scripts/seed.ts",
    "start": "medusa start",
    "dev": "medusa develop",
    "test:integration:http": "TEST_TYPE=integration:http NODE_OPTIONS=--experimental-vm-modules jest --silent=false --runInBand --forceExit",
    "test:integration:modules": "TEST_TYPE=integration:modules NODE_OPTIONS=--experimental-vm-modules jest --silent --runInBand --forceExit",
    "test:unit": "TEST_TYPE=unit NODE_OPTIONS=--experimental-vm-modules jest --silent --runInBand --forceExit"
  },
  "dependencies": {
    "@medusajs/admin-sdk": "latest",
    "@medusajs/cli": "latest",
    "@medusajs/framework": "latest",
    "@medusajs/medusa": "latest",
    "@mikro-orm/core": "5.9.7",
    "@mikro-orm/knex": "5.9.7",
    "@mikro-orm/migrations": "5.9.7",
    "@mikro-orm/postgresql": "5.9.7",
    "awilix": "^8.0.1",
    "cors": "^2.8.5",
    "pg": "^8.13.0"
  },
  "devDependencies": {
    "@medusajs/test-utils": "latest",
    "@mikro-orm/cli": "5.9.7",
    "@swc/core": "1.5.7",
    "@swc/jest": "^0.2.36",
    "@types/jest": "^29.5.13",
    "@types/node": "^20.0.0",
    "@types/react": "^18.3.2",
    "@types/react-dom": "^18.2.25",
    "jest": "^29.7.0",
    "prop-types": "^15.8.1",
    "react": "^18.2.0",
    "react-dom": "^18.2.0",
    "ts-node": "^10.9.2",
    "typescript": "^5.6.2",
    "vite": "^5.2.11"
  },
  "engines": {
    "node": ">=20"
  }
}

Node.js version

v22.11.0

Database and its version

PostgresSQL 17.0.1

Operating system name and version

Window

Browser name

Chrome

What happended?

CORS issue. I have seen couple of tickets in forum reporting the same issue. but no answers.
I have set everything as per the doc on main website. Also, it seems that doc is according to previous version of medusa.

Expected behavior

The API route should work
http://localhost:9000/auth/vendor/emailpass/register

Actual behavior

Its running fine in postman, and running good at backend, but when running it on frontend - http://localhost:8000/us
its showing CORS error

Link to reproduction repo

https://github.com/medusajs/examples

[olivermrbl]

Can you please add reproducible steps? The reproduction repo is our examples repository and not very helpful.

[julianengel]

@meenal9, when we had this issue, adding the correct localhost url to medusa-config.ts resolved it

    store_cors: 'http://localhost:3000',
    http: {
      storeCors: "http://localhost:3000",
      adminCors: process.env.ADMIN_CORS!,
      authCors: process.env.AUTH_CORS!,
      jwtSecret: process.env.JWT_SECRET || "supersecret",
      cookieSecret: process.env.COOKIE_SECRET || "supersecret",
    }

Postman sends it "server-side" which means that cors doesn't have to pass, whereas in the browser you always will have cors.
If you add it into the congi, restart, it should work :)

[meenal9]

I have a vendor dashboard running on port 3000. Initially, the Medusa storefront also wasn't working due to a similar issue, but I managed to resolve it by making some modifications in the middleware. However, the vendor dashboard on port 3000 is still not working.
Medusa admin - 9000
Medusa storefront - 8000
React Vendor Dashboard - 3000

I’ve updated both the medusa-config and the middleware, but I’m still encountering a CORS issue with a 204 error code.
Please help.. I am stuck

[khaledxyz]

I have a vendor dashboard running on port 3000. Initially, the Medusa storefront also wasn't working due to a similar issue, but I managed to resolve it by making some modifications in the middleware. However, the vendor dashboard on port 3000 is still not working. Medusa admin - 9000 Medusa storefront - 8000 React Vendor Dashboard - 3000

I’ve updated both the medusa-config and the middleware, but I’m still encountering a CORS issue with a 204 error code. Please help.. I am stuck

I'm experiencing the same issue. Have you found any solution yet?

[nilswsr]

@meenal9 & @khaledxyz
Since Medusa v2 no longer has separate auth endpoints /store/auth and /admin/auth, but instead the /auth endpoint is decoupled from both /store and /admin, this must also be considered in the CORS configuration.

Make sure that you define AUTH_CORS correctly so that all applications requiring authentication (whether for admin users or customers) are included in the definition.

My store application runs on port 3000, and my Medusa server runs on port 9000. Here are my CORS settings:

STORE_CORS=http://localhost:3000
ADMIN_CORS=http://localhost:9000
AUTH_CORS=http://localhost:3000,http://localhost:9000