There are a lot of CORS proxy servers like this one: https://cors-anywhere.herokuapp.com/

This allows us to send requests from different origins. For example I can send request from my client's frontend.com JS to GET whatever.com main page.

But I wonder - the server which hosts whatever.com will get my site user IP or the cors proxy server IP?

I think it definitely should be the cors server IP. Am I right?

1 Answer 1


If you are trying to defeat CORS you are actively trying to create insecurity and vulnerability for your end users. CORS was not created because we delight in creating unnecessary hurdles to make developers' lives miserable. (We do, but that's not why we did it this time!) CORS helps protect end users. It's super important and it is the way of the future. Here's a really good article explaining CORS. I would urge you not to look for ways to bypass it and work around it. Look for ways to get your web site working with it.

If you build a web site that depends on some proxying site in order to work, but you're not paying that proxy and you're not running that proxy, your whole web site might just stop working one day because that proxy goes offline. Or the user might have trouble reaching the proxy from their network location while they have no trouble reaching your web app from their location. The net result to your end user is that your app looks like it doesn't work, when it's really a problem with them reaching that proxy.

It's a sloppy workaround that bypasses a really useful security control. I'd urge you to rethink this approach.

To answer your question, yes, your javascript or XHR or JSON payloads will have to pass through the proxy. And that's the IP address you're going to see for some requests. It will hinder your ability to analyse who is visiting your site, expecially if anyone is doing something malicious.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .