CORS "Unauthorized origin" errors after deploying to our staging subdomain
Deployed our site to staging.brand.com and every single Croct request now fails. Production on brand.com works fine, same code, same app ID.
Console shows:
Access to fetch at 'https://api.croct.io/client/web/evaluate' from origin'https://staging.brand.com' has been blocked by CORS policyand the SDK surfaces it as an "Unauthorized origin" error. Nothing changed in the code between environments so what changed on the Croct side?
1 answer
Nothing changed on the Croct side, the staging domain was just never registered. "Unauthorized origin" means the requesting domain is not in your application's trusted origins list. Production works because brand.com is in the list; staging.brand.com is a different origin and needs its own entry.
Go to the application settings in the dashboard and add the staging domain to trusted origins. Requests start passing as soon as it is saved, no redeploy needed.
Worth doing for every environment you spin up, by the way. Trusted origins also gate preview links, so an untrusted domain silently breaks the preview flow too, and that one is much more confusing to debug than a CORS error in the console.
Added staging.brand.com to trusted origins and everything works. Good tip on preview links, would definitely have hit that next.