1. The problem I’m having:
I have a static website at my primary domain, say https://example.com.
On that website, I have an HTMX powered form that posts to a simple Go server that processes the form. caddy acts as reverse_proxy for the Go code.
caddy hosts the reverse_proxy on a subdomain, say https://reg.example.com.
I am struggling to overcome CORS issues, e.g. the following is printed in the browser console:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://reg.example.com/v1/foo. (Reason: CORS preflight response did not succeed). Status code: 405.
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://reg.example.com/v1/foo. (Reason: CORS request did not succeed). Status code: (null).
2. Error messages and/or full log output:
3. Caddy version:
v2.8.4 h1:q3pe0wpBj1OcHFZ3n/1nl4V4bxBrYoSoab7rL9BMYNk=
4. How I installed and ran Caddy:
Debian package
a. System environment:
Debian Bookworm
d. My complete Caddy config:
# Global options
{
persist_config off
admin :8219
servers {
metrics
}
}
# Common Headers
(commonheader) {
header {
-Server
Permissions-Policy interest-cohort=()
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options DENY
Referrer-Policy same-origin
Referrer-Policy origin
Content-Security-Policy "default-src https:;frame-src https://hcaptcha.com https://newassets.hcaptcha.com;frame-ancestors 'none';"
+Vary Origin
defer
}
}
# My Reg
(myregheader) {
header {
Access-Control-Allow-Origin "https://reg.example.com"
}
}
# My Reg Src
(myregsrc) {
header {
Access-Control-Allow-Origin "https://example.com"
}
}
# HTMX Headers
(htmxheader) {
header {
+Access-Control-Allow-Headers "HX-Current-URL,HX-Request"
+Access-Control-Expose-Headers "HX-Redirect"
}
}
# Common Fileserver
(commonfileserver) {
file_server {
hide .git
}
}
# Logging
(commonlogging) {
log {
format filter {
wrap console
fields {
request>remote_ip ip_mask {
ipv4 24
ipv6 48
}
request>client_ip ip_mask {
ipv4 24
ipv6 48
}
}
}
}
}
# Common Main
(commonmain) {
tls foobar@example.com {
ca https://acme-v02.api.letsencrypt.org/directory
}
encode {
zstd
gzip
}
}
# Individual sites
example.com, www.example.com {
root * /usr/local/share/www/example.com/public
import commonheader
import commonfileserver
import commonlogging
import commonmain
import htmxheader
import myregheader
}
reg.example.com {
import commonheader
import htmxheader
import myregsrc
reverse_proxy localhost:8619
}