Learn F5 Technologies, Get Answers & Share Community Solutions Join DevCentral

Filter by:
  • Solution
  • Technology

CORS as show stopper: Why does BigIP not send "Access-Control-Allow-Origin" headers?

Hi all,

I would like to access the iControl API from my local PC (whichis in a other domain as my BigIPs). Testing stuff with Postman is fine, but to get a nice quick view of things, a small HTML-File with Javascript that you can open locally in the browser would be much nicer.

I use Javascript's Fetch-API to do the calls, but the CORS Policy (Cross Origin Resource Sharing) hits me hard. As I can see from the Dev-Tools in Chrome, the BipIP does not send the appropriate response header "Access-Control-Allow-Origin", so no cross origin access is allowed.

I was wondering why this is the case. Should an API not be cross domain accessible? Do I miss anything obvious here? And why is Postman (which is an Electron app, so basically HTML and Javascript) is able to perform requests?

I really don't want to set up any server or install node.js on my PC just to fiddle around with that stuff.

So, is there any way to access the iControl API with local javascript?

Cheers, Ichnafi

Rate this Question
Comments on this Question
Comment made 04-Jun-2018 by Dan Bowman 210

Subscribing to this thread as I'm having the same issue. CORS is enforced by the browser client hence Postman works but Chrome etc don't.

Currently looking to implement a custom .NET web based client to do the REST calls but wouldn't need to if Access-Control-Allow-Origin could be specified on the BIG-IP!

Comment made 04-Jun-2018 by Ichnafi 220

Postman works, because it is basically a Node.js application. Because of that the CORS Policy does not apply.


Answers to this Question