Press CTRL+K to open search

CORS errors after deploying a new CMS instance

  • Published on Aug 26, 2026
  • 1 minute(s) read
  • G
 Prev Next

CORS errors after deploying a new CMS instance

:::info
Category: Environment & Configuration Issues

Applies to: New CMS client deployments on EKS or GKE

Quick Detection: If login or API requests fail immediately after a fresh deployment and DevTools shows CORS errors mentioning missing Access-Control-Allow-Origin, the client domain is likely not whitelisted.
:::

Symptoms

  • Freshly deployed CMS instance loads but login or API calls fail
  • Browser console shows CORS errors such as:
No 'Access-Control-Allow-Origin' header is present on the requested resource
  • Network requests fail with:
net::ERR_FAILED
  • Issue appears immediately after onboarding a new client domain
  • Existing environments and older domains continue to function normally

Likely Causes

  • The new client domain is not included in the backend CORS allowlist
  • Helm values for the target cloud environment are missing the domain entry
  • Backend services reject preflight requests from unrecognized origins

What to Check

  1. Open Browser DevTools → Console
    • Look for CORS errors referencing missing Access-Control-Allow-Origin
  2. Confirm the request origin
    • Verify the exact CMS domain from which requests are being made
  3. Verify Helm configuration for the deployment environment:
helm-charts/charts/management/<cloud_env>/values.<env>.yaml

where:

  • <cloud_env> = eks or gke
  • <env> = dev, staging, uat, prod
  1. Check whether the new client domain is present in the ALLOWED_ORIGINS field

How to Fix

Add the new client domain to the ALLOWED_ORIGINS list for the following services:

  • APP_NAME: management-appcms-service
  • APP_NAME: management-content-service
  • APP_NAME: management-appcms-service

File location:

helm-charts/charts/management/<cloud_env>/values.<env>.yaml

After updating:

  1. Commit the configuration change
  2. Redeploy the management services
  3. Verify the CMS instance again

Prevention Tips

  • Include CORS domain whitelisting in the new-client deployment checklist
  • Maintain a centralized registry of approved client domains
  • Validate ALLOWED_ORIGINS before announcing environment readiness

Related Issues

  • Login fails only on newly deployed client environments
  • API requests fail while frontend loads successfully
  • Preflight request failures in browser DevTools

ℹ️ Note
This issue is purely configuration-related and not caused by frontend application code.