CORS 500 errors when requesting "/graphql/execute.json" on dispatcher.

Hi @sreedobe,

Even though you're able to open the URL in the browser, JavaScript fetch calls from a different origin (localhost) are subject to browser CORS policy.

Chrome CORS plugin only bypasses for testing UI, not fetch requests inside code.

Assuming you are requesting from localhost: Your AEM server (wwwstage.companyx.com) must allow CORS requests from http://localhost:4400.

CORS is controlled via dispatcher/src/conf.d/available_vhosts/cors.any:

Example:

<LocationMatch "/graphql/.*">
    Header always set Access-Control-Allow-Origin "http://localhost:4400"
    Header always set Access-Control-Allow-Methods "GET, OPTIONS"
    Header always set Access-Control-Allow-Headers "Content-Type, Authorization"
    Header always set Access-Control-Allow-Credentials "true"
</LocationMatch>

Make sure:

• OPTIONS preflight is handled properly

• Allowed origins include localhost:4400

Then redeploy dispatcher code changes.

In dev or stage, allow wildcard (*) temporarily to unblock local testing, but don’t use this in production.

Could you check if your Vite proxy rule should map the entire path correctly?

export default defineConfig({
  server: {
    proxy: {
      '/graphql/execute.json': {
        target: 'https://wwwstage.companyx.com',
        changeOrigin: true,
        secure: false,
      },
    },
  },
});

Then fetch using:

fetch('/graphql/execute.json/quizzes/quizone')

Not the full external URL - Vite will proxy that for you.

This avoids CORS entirely in dev, because the browser thinks it’s calling localhost.

Alternatively, If you can’t change AEM CORS config and you need a workaround, you can:

• Write a simple Node/Express proxy server

• Forward GraphQL requests from localhost to AEM

• Avoids CORS since request is server-to-server

// vite.config.ts
'/api/graphql': {
  target: 'https://wwwstage.companyx.com',
  changeOrigin: true,
  rewrite: (path) => path.replace(/^\/api\/graphql/, '/graphql'),
}

 Hope this helps!

Hi @sreedobe ,

Try below steps:

Step 1: Add CORS Headers in Dispatcher

Edit the dispatcher config file:
dispatcher/src/conf.d/available_vhosts/cors.any

Add this block:

Step 2: Allow Preflight (OPTIONS) Requests

Ensure you don’t block OPTIONS in your /filter rules and that OPTIONS requests are forwarded to AEM. In dispatcher/src/conf.dispatcher.d/filters/filters.any: