# CORS header ‘Access-Control-Allow-Origin’ missing

**URL:** <https://opendataforum.transport.nsw.gov.au/t/cors-header-access-control-allow-origin-missing/683>\
**Category:** App development\
**Created:** [March 20, 2017, 1:00pm UTC](https://opendataforum.transport.nsw.gov.au/t/cors-header-access-control-allow-origin-missing/683 "2017-03-20T13:00:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dhamu143](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dhamu143](https://opendataforum.transport.nsw.gov.au/u/dhamu143)\
**Post date:** [March 20, 2017, 1:00pm UTC](https://opendataforum.transport.nsw.gov.au/t/cors-header-access-control-allow-origin-missing/683/1 "2017-03-20T13:00:00Z")

</div>

i am accessing trip planning api [https://api.transport.nsw.gov.au/v1/tp/trip](https://api.transport.nsw.gov.au/v1/tp/trip) with api key. its perfectly working by postman but when i try to access this api by my code i am getting CORS error. error is as below in detail.

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource  
(Reason: CORS header ‘Access-Control-Allow-Origin’ missing)

please help

---

<div class="post-metadata">

**Author:** ![alejandro.felman](https://avatars.discourse-cdn.com/v4/letter/a/bbe5ce/32.png) [@alejandro.felman](https://opendataforum.transport.nsw.gov.au/u/alejandro.felman)\
**Post date:** [March 21, 2017, 1:29am UTC](https://opendataforum.transport.nsw.gov.au/t/cors-header-access-control-allow-origin-missing/683/2 "2017-03-21T01:29:32Z")

</div>

This was answered in [Not able to authenticate appication with bearer token in trip planner API - #5 by jxeeno](http://opendataforum.transport.nsw.gov.au/t/not-able-to-authenticate-appication-with-bearer-token-in-trip-planner-api/659/5)

---

<div class="post-metadata">

**Author:** ![jayen](https://sea1.discourse-cdn.com/flex019/user_avatar/opendataforum.transport.nsw.gov.au/jayen/32/208_2.png) [@jayen](https://opendataforum.transport.nsw.gov.au/u/jayen)\
**Post date:** [March 8, 2018, 10:55pm UTC](https://opendataforum.transport.nsw.gov.au/t/cors-header-access-control-allow-origin-missing/683/3 "2018-03-08T22:55:14Z")

</div>

Given the number of people hitting CORS issues, would you consider enabling it? I see it is already enabled for opendata.transport.nsw.gov.au . Maybe if there is no mechanism for us to specify our origins with the portal, we could maybe mail you a list for you to update?

---

<div class="post-metadata">

**Author:** ![anubhav](https://avatars.discourse-cdn.com/v4/letter/a/5e9695/32.png) [@anubhav](https://opendataforum.transport.nsw.gov.au/u/anubhav)\
**Post date:** [June 20, 2021, 9:43pm UTC](https://opendataforum.transport.nsw.gov.au/t/cors-header-access-control-allow-origin-missing/683/4 "2021-06-20T21:43:16Z")

</div>

I know this is late but I wanted to let people know why CORS is actually a good thing.  
If you get a CORS error, it means you are calling the API from client side code. This means your API key among other things has to be visible to the client. Someone can then just have a look at source, use your API and exploit it. This is why API calls should be handled from server side.