CORS Problem after deploying docker separately question

[DxMikel]

Using documentation for deploy on docker separately I create both docker images and running put all de environments as described but when finish configurate an error appears after looking for console dev tools realize I have CORS Error what am I doing wrong with configuration or did I misunderstand something on variable?

I am using latest docker version for both

environment for backend:

APP_KEY=base64:G/ZFls3t
APP_SAAS_MODE_ENABLED=true
APP_FRONTEND_URL=https://evento.gymbalalai.com
APP_SAAS_STRIPE_APPLICATION_FEE_PERCENT=1.5
FILESYSTEM_PUBLIC_DISK=public
FILESYSTEM_PRIVATE_DISK=local
JWT_SECRET=ewb9o
LOG_CHANNEL=stderr
DB_CONNECTION=pgsql
DB_HOST=
DB_PORT=5432
DB_DATABASE=postgres
DB_USERNAME=postgres
DB_PASSWORD=

environment for frontend:
VITE_FRONTEND_URL=https://evento.gymbalalai.com
VITE_API_URL_CLIENT=https://eventoback.gymbalalai.com/api
VITE_API_URL_SERVER=https://eventoback.gymbalalai.com/api

[daveearley]

Hi @DxMikel,

The issue is likely that you have not updated the CORS_ALLOWED_ORIGINS environment variable. If you add https://eventoback.gymbalalai.com it should work.

Thanks for flagging this, as the information was missing from the docs. I've updated the docs.

[DxMikel]

Hi @daveearley,
thanks for answer me unfortunely it doesn't work I try different configuration for environment variables on both cases I add CORS_ALLOWED_ORIGINS

frontend env variables
VITE_FRONTEND_URL=https://evento.gymbalalai.com
VITE_API_URL_CLIENT=https://eventoback.gymbalalai.com/api
VITE_API_URL_SERVER=https://eventoback.gymbalalai.com/api

backend env
CORS_ALLOWED_ORIGINS=https://evento.gymbalalai.com

even I try to change frontend variable to
VITE_FRONTEND_URL=https://evento.gymbalalai.com
VITE_API_URL_CLIENT=https://evento.gymbalalai.com/api
VITE_API_URL_SERVER=https://evento.gymbalalai.com/api

but another issue is happening and don't know why

and when this happen on database I don't have any user create

also looking for another backend env I add both
CORS_ALLOWED_ORIGINS=https://evento.gymbalalai.com,https://eventoback.gymbalalai.com

and cors issue still appearing

still don't know what env variable I misconfigured

[daveearley]

Chrome is quite poor for diagnosing CORS errors, but if you open Firefox you can see the preflight OPTIONS request is failing and returning a 502 Bad Gateway error.

How are you deploying your containers?

[DxMikel]

I'm using portainer as Docker Management and pulling image from documentation
daveearley/hi.events-frontend
daveearley/hi.events-backend
not sure why it has 502 error on logs it shows ok

[JSkye3293]

I have been looking into this extensively. I have also the same issue on the all-in-one docker deployment, it appears on the backend after I fix the 401 error that is causing a cors issue but it appears that firefox will drop all cookies sent from my server not just login tokens. I can get it to work on my localhost by setting the env's to 127.0.0.1 and the respective ports, at that point it will load past the login and pull up the dash. I have tried to reverse proxy with this setup using local NGINX proxing, but to no avail. Something outside of the .env file seems to ba a hardcoded culprit and I cannot figure out where. I have investigated just using redis for session and login storage which according to what i have found would bypass this cors issue and cookie storage as well as allow my reverse proxy to work correctly. I can post the working localhost .env as well as my proxy file that i am using.

Its important to note that the specific cookies that are being dropped are /me and anything to do with session storage.

See the README.md file for information on how to generate the JWT_SECRET and APP_KEY

Any IP address that is not localhost has been removed and replaced with 192.168.1.2.
Copy of working .env for localhost:

`
APP_KEY=REDACTED
JWT_SECRET=REDACTED

Frontend variables (Always prefixed with VITE_)

VITE_FRONTEND_URL=/
VITE_API_URL_CLIENT=/api
VITE_API_URL_SERVER=/api
VITE_STRIPE_PUBLISHABLE_KEY=pk_test_123456789
VITE_APP_NAME=Hi.Events

Backend variables

These values may not be suitable for production environments.

Please refer to the documentation for more information on how to configure these values

https://hi.events/docs/getting-started/deploying

LOG_CHANNEL=stderr
QUEUE_CONNECTION=redis

Application settings

APP_CDN_URL=http://127.0.0.1:8123/storage
APP_FRONTEND_URL=http://127.0.0.1:8123
APP_DISABLE_REGISTRATION=false
APP_SAAS_MODE_ENABLED=false
APP_SAAS_STRIPE_APPLICATION_FEE_PERCENT=0
APP_SAAS_STRIPE_APPLICATION_FEE_FIXED=0
APP_EMAIL_LOGO_URL=
APP_EMAIL_LOGO_LINK_URL=

Security bypass for local networking

SANCTUM_STATEFUL_DOMAINS=192.168.1.2,192.168.1.2:81,localhost,127.0.0.1
SESSION_SECURE_COOKIE=false
COOKIE_SECURE=false

SESSION_DOMAIN=192.168.1.2
SESSION_DRIVER=cookie

CORS settings (Add this line if it exists, or create it)

CORS_ALLOWED_ORIGINS=http://192.168.1.2:81,http://192.168.1.2,http://localhost:8123

Email settings (Using log mailer for local testing)

MAIL_MAILER=log
MAIL_DRIVER=log
MAIL_HOST=mail.local
MAIL_PORT=1025
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_ADDRESS=test@example.com
MAIL_FROM_NAME="Hi Events"

File storage settings

FILESYSTEM_PUBLIC_DISK=public
FILESYSTEM_PRIVATE_DISK=local

Database settings

POSTGRES_DB=hi-events
POSTGRES_USER=postgres
POSTGRES_PASSWORD=secret
DATABASE_URL=postgresql://postgres:secret@postgres:5432/hi-events

Stripe settings (Replace with valid test keys if necessary)

STRIPE_PUBLIC_KEY=pk_test_123456789
STRIPE_SECRET_KEY=sk_test_123456789
STRIPE_WEBHOOK_SECRET=whsec_test_123456789

Redis settings

REDIS_HOST=redis
REDIS_PASSWORD=
REDIS_PORT=6379

TRUSTED_PROXIES=*

Copy of NGINX Proxy File

server {
listen 81;
server_name 192.168.1.2 ticketing.example.com;

# Redirect all HTTP traffic to HTTPS
return 301 https://$host$request_uri;

}

server {
listen 443 ssl;
server_name 192.168.1.2 ticketing.example.com;

# SSL Certificate Paths
ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;

# Basic SSL Hardening (Optional but Recommended)
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;

location / {
    # Define the backend app location
    proxy_pass http://127.0.0.1:8123;

    # Pass essential headers to the backend application
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

}

Please let me know what you find. Thanks!