CORS error when querying composedb graphql endpoint

i’ve got the graphql server running and working fine with graphiql and postman, but browser queries are getting rejected with a CORS error. I see the cors-allowed-origin property in daemon.config.json is set to .*, which I would think means no endpoint limitations, and I have tried adding my localhost port with no success. is there another way to configure the graphql server to set headers, or some other workaround to address the CORS error?

Can you post the full logs and error messages you are seeing? Sometimes CORS errors are a red herring that mask the true issue

here’s the full error

Access to fetch at 'http://localhost:4004/graphql/' from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

 POST http://localhost:4004/graphql/ net::ERR_FAILED
(anonymous)	@	makeGraphQlFetchCall.js:36
(anonymous)	@	makeGraphQlFetchCall.js:27
__webpack_modules__.../account-sdk-ts/dist/src/helpers/makeGraphQlFetchCall.js.__awaiter	@	makeGraphQlFetchCall.js:9
makeGraphQlFetchCall	@	makeGraphQlFetchCall.js:35
(anonymous)	@	loadAccount.js:57
(anonymous)	@	loadAccount.js:27
__webpack_modules__.../account-sdk-ts/dist/src/accountSdkFunctions/loadAccount.js.__awaiter	@	loadAccount.js:9
loadAccount	@	loadAccount.js:37
(anonymous)	@	index.js:61
(anonymous)	@	index.js:27
__webpack_modules__.../account-sdk-ts/dist/index.js.__awaiter	@	index.js:9

I’ve redone creating and deploying a compose db schema a few times now with the same CORS error happening each time. i’ve tried using a tunnel to get it away from using localhost, but still the same issue. is there an example app I can check out, or additional resources to explore to find out where it’s going wrong? or is there a way to access the headers in the graphql server?

@deptofzane - can you share your daemon.config.json file?

@stickykeys @paul - any ideas here?

sure thing! here’s the daemon.config.json

  "anchor": {},
  "http-api": {
    "cors-allowed-origins": [
    "admin-dids": ["did:key:z6MkggdnaVJYKBLA4bdoLNdpWRi2ubYGjG2LdjUyk8wxbqce"]
  "ipfs": {
    "mode": "bundled"
  "logger": {
    "log-level": 2,
    "log-to-files": false
  "metrics": {
    "metrics-exporter-enabled": false,
    "metrics-port": 9090
  "network": {
    "name": "testnet-clay"
  "node": {},
  "state-store": {
    "mode": "fs",
    "local-directory": "/Users/zane/.ceramic/statestore/"
  "indexing": {
    "db": "sqlite:///Users/zane/.ceramic/indexing.sqlite",
    "allow-queries-before-historical-sync": true,
    "models": ["kjzl6hvfrbw6c8oy6mrpsqy1kkis9sv0qbmt9033zq8daeitzjoinjhzltve7tu","kjzl6hvfrbw6cb9qfyas621fs0mm1ygnobz9sm35o81tum15bysnqtocjbohqev"]

As far as I know only the ComposeDB devtools and CLI expose a GraphQL endpoint for the GraphiQL UI, but it’s not intended to support interactions from external apps.

Gotcha. I’m used to interacting with a /graphql endpoint, and I guess I was thrown off since it works with Postman. Got it going now with executeQuery