# Dealing with 'Access-Control-Allow-Origin' header **URL:** \ **Category:** APIs & Integrations\ **Created:** [October 13, 2016, 1:51am UTC](https://community.hubspot.com/t/dealing-with-access-control-allow-origin-header/12012 "2016-10-13T01:51:57Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![system](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/system/32/124_2.png) [@system](https://community.hubspot.com/u/system)\ **Post date:** [October 13, 2016, 1:51am UTC](https://community.hubspot.com/t/dealing-with-access-control-allow-origin-header/12012/1 "2016-10-13T01:51:57Z")
While testing on my local environment I use a CORS plugin to be able to do this kind of request . However when deployed im getting the CORS error. How can I bypass this limitation so that newsletter works on my live site. The error im getting is the following. XMLHttpRequest cannot load [https://forms.hubspot.com/uploads/form/v2/4506xx/xxe6eaa5-xxxx-4f81-a498-1198687031f7](https://forms.hubspot.com/uploads/form/v2/4506xx/xxe6eaa5-xxxx-4f81-a498-1198687031f7). No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘[https://jerxxx-fe-dev.xxxx.com](https://jerxxx-fe-dev.xxxx.com)’ is therefore not allowed access. Note: live site address is censored. I can provide it if needed ---
**Author:** ![Dadams](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/dadams/32/21752_2.png) [@Dadams](https://community.hubspot.com/u/Dadams)\ **Post date:** [October 13, 2016, 4:56pm UTC](https://community.hubspot.com/t/dealing-with-access-control-allow-origin-header/12012/2 "2016-10-13T16:56:39Z")
[@luisfoundation](https://community.hubspot.com/u/luisfoundation) our APIs don’t support CORS requests, so if you’re using JavaScript for this, you’d need to send the data from the page to your server, and then have your server make the request to HubSpot. [developers.hubspot.com](https://developers.hubspot.com/docs/faq/do-hubspot-apis-support-ajax-request) ### [Do HubSpot APIs support CORS / AJAX requests?](https://developers.hubspot.com/docs/faq/do-hubspot-apis-support-ajax-request) At this time, HubSpot APIs do not support support cross-origin (CORS) AJAX requests. In order to use AJAX, you would need to make the request to an external proxy server that could then make requests to HubSpot’s APIs. ---
**Author:** ![system](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/system/32/124_2.png) [@system](https://community.hubspot.com/u/system)\ **Post date:** [September 11, 2018, 8:59pm UTC](https://community.hubspot.com/t/dealing-with-access-control-allow-origin-header/12012/3 "2018-09-11T20:59:19Z")
I ran into this same issue the other day and [wrote up some instructions on how I got around this issue](https://www.kelp.agency/blog/how-to-enable-cors-ajax-requests-for-any-hubspot-api). The gist of the post is: use your own server to make the server side request and then dump the json onto your page and enable CORS. Then you can make all the AJAX calls that you need. It only takes two lines of PHP so it’s very simple to do. ---
**Author:** ![system](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/system/32/124_2.png) [@system](https://community.hubspot.com/u/system)\ **Post date:** [February 7, 2017, 1:28pm UTC](https://community.hubspot.com/t/dealing-with-access-control-allow-origin-header/12012/4 "2017-02-07T13:28:34Z")
Is this on your roadmap to add? Would be very convenient as we’re using a static site builder so have no backend to submit to. Currently our forms submit to FormBucket but would like to submit these directly to HubSpot. ---
**Author:** ![Dadams](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/dadams/32/21752_2.png) [@Dadams](https://community.hubspot.com/u/Dadams)\ **Post date:** [February 7, 2017, 10:28pm UTC](https://community.hubspot.com/t/dealing-with-access-control-allow-origin-header/12012/5 "2017-02-07T22:28:59Z")
We have some long term plans to allow AJAX requests specifically for form submissions, but we don’t have any plans to allow that for our APIs in general. ---
**Author:** ![system](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/system/32/124_2.png) [@system](https://community.hubspot.com/u/system)\ **Post date:** [March 20, 2017, 5:10pm UTC](https://community.hubspot.com/t/dealing-with-access-control-allow-origin-header/12012/6 "2017-03-20T17:10:09Z")
Any news on this? I am also running into the same issue. Unfortunately, our website was built by a third-party and I don’t have the ability to send the request from the server. All I’m trying to do is to submit a form through a JQuery post request. ---
**Author:** ![system](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/system/32/124_2.png) [@system](https://community.hubspot.com/u/system)\ **Post date:** [April 4, 2017, 10:52am UTC](https://community.hubspot.com/t/dealing-with-access-control-allow-origin-header/12012/7 "2017-04-04T10:52:45Z")
I’d love to have this too. I need this for the form submission endpoint. ---
**Author:** ![3PETE](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/3pete/32/61905_2.png) [@3PETE](https://community.hubspot.com/u/3PETE)\ **Post date:** [April 4, 2017, 12:46pm UTC](https://community.hubspot.com/t/dealing-with-access-control-allow-origin-header/12012/8 "2017-04-04T12:46:04Z")
[@ozzyonfire](https://community.hubspot.com/u/ozzyonfire) [@MartinMuzatko](https://community.hubspot.com/u/martinmuzatko) There aren’t any plans to release this is the short run so I do not have any update for you. [@ozzyonfire](https://community.hubspot.com/u/ozzyonfire) Could you host your own server to proxy the data through to HubSpot? You could make an AJAX request to your own server and then make the proper server-side request to HubSpot to submit the form data. ---
**Author:** ![system](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/system/32/124_2.png) [@system](https://community.hubspot.com/u/system)\ **Post date:** [April 4, 2017, 1:01pm UTC](https://community.hubspot.com/t/dealing-with-access-control-allow-origin-header/12012/9 "2017-04-04T13:01:08Z")
Ya that’s exactly what I ended up doing. ---
**Author:** ![system](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/system/32/124_2.png) [@system](https://community.hubspot.com/u/system)\ **Post date:** [March 5, 2018, 7:54pm UTC](https://community.hubspot.com/t/dealing-with-access-control-allow-origin-header/12012/10 "2018-03-05T19:54:22Z")
Does this still need to be handled by proxying from another server to Hubspot? ---
**Author:** ![3PETE](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/3pete/32/61905_2.png) [@3PETE](https://community.hubspot.com/u/3PETE)\ **Post date:** [March 6, 2018, 2:10pm UTC](https://community.hubspot.com/t/dealing-with-access-control-allow-origin-header/12012/11 "2018-03-06T14:10:12Z")
[@foundryideas](https://community.hubspot.com/u/foundryideas) Yes, there hasn’t been any changes on this front. ---
**Author:** ![windsorperma](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/windsorperma/32/78108_2.png) [@windsorperma](https://community.hubspot.com/u/windsorperma)\ **Post date:** [April 7, 2020, 5:41am UTC](https://community.hubspot.com/t/dealing-with-access-control-allow-origin-header/12012/12 "2020-04-07T05:41:38Z")
This is happening because of the [CORS](http://net-informations.com/js/err/xml.htm) (Cross Origin Resource Sharing) . For every HTTP request to a domain, the browser attaches any HTTP cookies associated with that domain. This is especially useful for authentication, and setting sessions. You are doing an XMLHttpRequest to a different domain than your page is on. So the browser is blocking it as it usually allows a request in the same origin for security reasons. You need to do something different when you want to do a cross-domain request. JSONP ( JSON with Padding ) is a method commonly used to bypass the cross-domain policies in web browsers. You’re on domain [example.com](http://example.com) , and you want to make a request to domain [example.net](http://example.net) . To do so, you need to cross domain boundaries. JSONP is really a simple trick to overcome the XMLHttpRequest same domain policy. So, instead of using XMLHttpRequest we have to use \< script \> HTML tags, the ones you usually use to load JavaScript files , in order for JavaScript to get data from another domain. ---
**Author:** ![davidoff2drew](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/davidoff2drew/32/80657_2.png) [@davidoff2drew](https://community.hubspot.com/u/davidoff2drew)\ **Post date:** [October 30, 2020, 7:13pm UTC](https://community.hubspot.com/t/dealing-with-access-control-allow-origin-header/12012/13 "2020-10-30T19:13:29Z")
Been a few years. Any updates on this front? ---
**Author:** ![CBourassa](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@CBourassa](https://community.hubspot.com/u/CBourassa)\ **Post date:** [January 20, 2022, 9:49pm UTC](https://community.hubspot.com/t/dealing-with-access-control-allow-origin-header/12012/14 "2022-01-20T21:49:35Z")
we have a nodejs/riot.js website running on javascript. We use JSON to add contacts to Hubspot but we keep getting the Cors error. Any ways to fix that from the code? It’s kind or urgent. ---
**Author:** ![RobertBardan](https://avatars.discourse-cdn.com/v4/letter/r/bbce88/32.png) [@RobertBardan](https://community.hubspot.com/u/RobertBardan)\ **Post date:** [January 18, 2024, 2:09pm UTC](https://community.hubspot.com/t/dealing-with-access-control-allow-origin-header/12012/15 "2024-01-18T14:09:05Z")
Hubpsot, the thing is that you don’t offer a way to communicate between your iframe and the main window(at least I didn’t found one). I’ve added a poup tou my Hubspot site and I am not able to listen for the form submit that’s inside the popup created with your system.