Call external URL in H5 script

Hi,

I am trying to call external URL in H5 script.

However we are getting errors as Request header field passthrough is not allowed by Access-Control-Allow-Headers in preflight response.

Can anyone proivde some input on the same.

Thanks & Regards,

Jagannath

Find more posts tagged with

Accepted answers

All comments

Legacy Contributor

The server that you are calling does not allow the domain where H5 is installed to talk to it. During the pre-flight check that domain is not configured as an allowed domain on the server (external URL) that you are calling. You will need to contact the admins of the service that you are calling and ask them to add the domain that you have for the H5 application.

This is standard CORS, Cross-origin resource sharing security in the web browser.

en.wikipedia.org/.../Cross-origin_resource_sharing

Legacy Contributor

If the other end is unable to allow your origin as Karin suggests, then an option would be to register the external web service in the ION gateway and have your H5 script call the service in ION. An H5 script calling an ION registered service should have no CORS issues.

Legacy Contributor

Hi Henrik,

Thank you for the response.

Do you have a sample example about how to create a ION gateway and calling service in H5?

Can you please share the same it will be very helpful.

Thanks & Regards,

Jagannath Sawant

Legacy Contributor

Hi,

For ION API you register the service that you would like to call and configure the endpoint. Then in the H5 Script you would call the ION API endpoint instead of the service and there would be no CORS issue. The example code would be exactly the same as you have now, but you call the ION API endpoint instead.

How to configure the endpoint in ION API is of course something to look up in the documentation. There are also a few videos to watch, for example this one: [View:https://www.youtube.com/watch?v=N_LwFt532e4:1040:625]

One thing that you did not mention was how the authentication and authorization is handled towards this service? You can have a configuration in ION that is shared by all users, and this is much better than having something in the H5 Script, because you should NEVER hardcode any API keys or anything into a H5 Script.

Legacy Contributor

If I am not mistaken the external API doesn't even need to have Swagger documentation if all you want to do is pass through the request from for example an H5 script. Only if you need to use the external web service inside of an ION workflow do you need to have a Swagger doc for the external service.

Legacy Contributor

Hi,

The external API has an API key. It is a Government portal so and the API access is to be purchased.

The key will remain the same for the customer who purchases the access.

Thanks,

Regards,

Jagannath Sawant

antonio-caria

Every external URL should be HTTPS always.

Unless You disable security from browser....

Legacy Contributor

Yes, but https or http is not related to CORS issues. And never change security settings in the browser unless you are changing to make it more strict.

antonio-caria

Of course CORS apply only to HTTP.

about the security that's a user problem...

Copyright © 2025 Infor. All rights reserved.