I have an API and a web application that exist in different domains. I can activate CORS on the API to allow for the web application to interface with the API cross-domain.

However it has been brought to my attention that some business, for corporate IT reasons, will opt to block cross-domain requests from their installed browsers for security reasons. If this is the case it is beyond my control. Can anyone comment on this? Has anyone working in corporate IT, or supporting web applications used by them, encountered such an issue before?

1 Answer 1


I would say that your issue has two sites:


Apparently InfoSec/ITSec department in you company decided to block by default cross-origin domain requests. It can be somehow rationally justified. It minimises the risk of data leakage between applications. I have seen once similar approach, so your company is not the only one.


If you are unable to request servers via CORS you can always proxify your traffic from web browser via your app/web server. I don't know which operating system you use, but in case of Linux you can try to use i.e. Squid. The assumption is that there is connectivity between your app/web server and this second domain server.

Squid (proxy in general) is not difficult to configure, and it will certainly work. However, it is better to consult this solution with your business/InfoSec/ITSec.

I hope I helped somehow.

  • @steviekins : Glad I could help! +1 will be more than welcome :) Commented May 8, 2014 at 10:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .