CORS Issue

[jeetenkumarsingh]

Getting cors error while accessing HTTPS enabled API. How to solve it.

[github-actions]

Official Statement from the SHKeeper Development Team

We would like to clarify that the SHKeeper development team consists solely of the following:

• @vsyshost
• @dmytro-samoylenko
• @Olxndr
• @yukonet

It is managed through our official GitHub account https://github.com/vsys-host

We NEVER:

• Share or redirect users to unofficial or suspicious links.
• Request private keys, funds, or other sensitive information.

If you encounter any comments, issues, or users claiming to represent SHKeeper and sharing external links or providing questionable support, please report them immediately. These individuals are not affiliated with the SHKeeper team.

For accurate information and official support, please refer only to:

Our GitHub account: https://github.com/vsys-host/shkeeper.io
Our official SHKeeper website: https://shkeeper.io/
Our official VSYS Host website: https://vsys.host/

Thank you for your understanding and vigilance.

SHKeeper Development Team

[yukonet]

Could you please provide more details so we can investigate?
The exact CORS error messages you’re seeing in the browser console.
Relevant SHKeeper logs from the time of the request.
This will help us better understand the issue and suggest a solution.

[jeetenkumarsingh]

please check image . I tried to access API from my domain ,but it fails with CORS error. Please suggest necessary steps.

[yukonet]

We noticed that you are invoking the payment_request method directly from a browser.
Please note that this approach is not supported and poses significant security risks. Browser requests may expose sensitive data, which could be intercepted and misused to perform unauthorized fund withdrawals.

For security reasons, access to SHKeeper should be strictly limited to your administrator system and billing backend, not client-side applications.

If, despite these warnings, you still need to enable browser-based access (e.g., for testing purposes), you will need to configure CORS by setting the Access-Control-Allow-Origin header. This can be done in your ssl.yaml file, replacing the domains with your own:

---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: shkeeper-cert
  namespace: shkeeper
spec:
  commonName: demo.shkeeper.io
  secretName: shkeeper-cert
  dnsNames:
    - demo.shkeeper.io
  issuerRef:
    name: letsencrypt-production
    kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-production
spec:
  acme:
    email: support@v-sys.org
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: your-own-very-secretive-key
    solvers:
      - http01:
          ingress:
            class: traefik
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: cors-headers
  namespace: shkeeper
spec:
  headers:
    accessControlAllowOriginList:
      - "*"   # Or replace "*" with a specific domain like "https://example.com"
    accessControlAllowMethods:
      - GET
      - POST
      - OPTIONS
      - PUT
      - DELETE
    accessControlAllowHeaders:
      - "*"
    accessControlAllowCredentials: true
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: shkeeper
  namespace: shkeeper
spec:
  entryPoints:
    - web
    - websecure
  routes:
    - match: Host(`demo.shkeeper.io`)
      kind: Rule
      services:
        - name: shkeeper
          port: 5000
          namespace: shkeeper
      middlewares:
        - name: cors-headers
          namespace: shkeeper
  tls:
    secretName: shkeeper-cert

Important: We strongly recommend avoiding this setup in production environments and instead routing requests through your server-side billing system.