CORS error when testing the Sample MediaCo app with the latest master branch

[ozsaffer]

I was successfully testing the sample MediaCo app and after pulling the latest changes from the master branch, I am now getting a CORS error with the portals call, however the D_pxBootstrapConfig call is working successfully
Access to XMLHttpRequest at 'https://......./prweb/app/MediaCo/api/application/v2/portals/MediaCo' from origin 'http://localhost:3502' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Portals call (failing):
curl 'https://..../prweb/app/MediaCo/api/application/v2/portals/MediaCo' \ -H 'sec-ch-ua: "Microsoft Edge";v="119", "Chromium";v="119", "Not?A_Brand";v="24"' \ -H 'DNT: 1' \ -H 'sec-ch-ua-mobile: ?0' \ -H 'Authorization: bearer ...' \ -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0' \ -H 'Accept: application/json, text/plain, */*' \ -H 'Referer: http://localhost:3502/' \ -H 'context: root' \ -H 'X-Constellation-App: Pega' \ -H 'sec-ch-ua-platform: "Windows"' \ --compressed

D_pxBootstrapConfig call(working ):
curl 'https://weecfin1.pegace.net/prweb/app/MediaCo/api/application/v2/data_views/D_pxBootstrapConfig' \ -H 'authority: weecfin1.pegace.net' \ -H 'accept: */*' \ -H 'accept-language: en-AU,en;q=0.9' \ -H 'authorization: bearer ' \ -H 'dnt: 1' \ -H 'origin: http://localhost:3502' \ -H 'referer: http://localhost:3502/' \ -H 'sec-ch-ua: "Microsoft Edge";v="119", "Chromium";v="119", "Not?A_Brand";v="24"' \ -H 'sec-ch-ua-mobile: ?0' \ -H 'sec-ch-ua-platform: "Windows"' \ -H 'sec-fetch-dest: empty' \ -H 'sec-fetch-mode: cors' \ -H 'sec-fetch-site: cross-site' \ -H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0' \ --compressed1

[tumms2021389]

can you try adding "x-constellation-app" header in the allowed headers list

Steps to get rid of CORS issue:
- Open API Headers Allowed record
- security => Cross Origin Resource Sharing => APIHeadersAllowed
- Add this ‘x-constellation-app’ at the end of allowed headers

[ozsaffer]

Thanks for that, it is now working.