# Best practice for creating APIs that can be called from other domains

**URL:** <https://discourse.nodered.org/t/best-practice-for-creating-apis-that-can-be-called-from-other-domains/37657>\
**Category:** General\
**Created:** [17 December 2020 15:29 UTC](https://discourse.nodered.org/t/best-practice-for-creating-apis-that-can-be-called-from-other-domains/37657 "2020-12-17T15:29:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tim-m](https://avatars.discourse-cdn.com/v4/letter/t/dc4da7/32.png) [@tim-m](https://discourse.nodered.org/u/tim-m)\
**Post date:** [17 December 2020 15:29 UTC](https://discourse.nodered.org/t/best-practice-for-creating-apis-that-can-be-called-from-other-domains/37657/1 "2020-12-17T15:29:46Z")

</div>

Hi! I'm building a number of APIs via NodeRED (on a Cloud) that I want to expose and want to get it right in terms of security and cors. I've secured the routes exposed by the HTTP In nodes using basic authentication. I can call those fine from external apps EXCEPT when it comes to using DropzoneJS. I can upload files via DropzoneJS fine but when I try and display image files (that would be displayed as thumbnail) that have already been uploaded I get cors errors. Does anyone have any best practice info about handling cors with nodeRED?

This is the error I get from DropzoneJS:

```auto
dropzone.min.js:1 Uncaught DOMException: Failed to execute 'getImageData' on 
'CanvasRenderingContext2D': The canvas has been tainted by cross-origin data.
 at detectVerticalSquash 
(https://[mysite]/packages/dropzone-5.7.0/dist/min/dropzone.min.js:1:44867) 
at drawImageIOSFix (https://[mysite]/packages/dropzone-5.7.0/dist/min/dropzone.min.js:1:45025) 
at https://[mysite]/packages/dropzone-5.7.0/dist/min/dropzone.min.js:1:30055 at 
e (https://[mysite]/packages/dropzone-5.7.0/dist/min/dropzone.min.js:1:29266) at 
HTMLImageElement.d.onload (https://[mysite]/packages/dropzone-
5.7.0/dist/min/dropzone.min.js:1:29414)

||detectVerticalSquash|@|dropzone.min.js:1|
| --- | --- | --- | --- |
||drawImageIOSFix|@|dropzone.min.js:1|
||(anonymous)|@|dropzone.min.js:1|
||e|@|dropzone.min.js:1|
||d.onload|@|dropzone.min.js:1|
||load (async)|||
||value|@|dropzone.min.js:1|
||value|@|dropzone.min.js:1|
||(anonymous)|@|avatar:1073|
||Promise.then (async)|||
||(anonymous)|@|avatar:1060|
||Promise.then (async)|||
||(anonymous)|@|avatar:977|

```

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [17 December 2020 18:03 UTC](https://discourse.nodered.org/t/best-practice-for-creating-apis-that-can-be-called-from-other-domains/37657/2 "2020-12-17T18:03:01Z")

</div>

I don't have any experience with that library so I can't be certain but I wonder if it tries to load some resources from a different domain? If so, you will have to configure CORS to allow for that. Maybe disable CORS, lot the endpoint and use the browser dev tools to see exactly what it does.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [15 February 2021 18:03 UTC](https://discourse.nodered.org/t/best-practice-for-creating-apis-that-can-be-called-from-other-domains/37657/3 "2021-02-15T18:03:07Z")

</div>

Closed on 15 February 2021 18:03 UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.