# Been blocked by CORS policy Angular

**URL:** <https://devforum.okta.com/t/been-blocked-by-cors-policy-angular/7237>\
**Category:** Questions\
**Created:** [December 9, 2019, 6:30am UTC](https://devforum.okta.com/t/been-blocked-by-cors-policy-angular/7237 "2019-12-09T06:30:06Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![dev01.ps](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@dev01.ps](https://devforum.okta.com/u/dev01.ps)\
**Post date:** [December 9, 2019, 6:30am UTC](https://devforum.okta.com/t/been-blocked-by-cors-policy-angular/7237/1 "2019-12-09T06:30:06Z")

</div>

Access to XMLHttpRequest at ‘[https://dev-511202.okta.com/api/v1/users/me](https://dev-511202.okta.com/api/v1/users/me)’ from origin ‘[http://localhost:4200](http://localhost:4200)’ has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’ header is present on the requested resource.

I have Follow the same steps as mention which has been mention

See screen shot [http://prntscr.com/q84u47](http://prntscr.com/q84u47)

---

<div class="post-metadata">

**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\
**Post date:** [December 9, 2019, 6:37am UTC](https://devforum.okta.com/t/been-blocked-by-cors-policy-angular/7237/2 "2019-12-09T06:37:32Z")

</div>

Hi @dev01.ps

A CORS error can occur if the endpoint returns a 40\* error (eg. if you are not logged in). Can you please check if you have an active session in Okta and are sending the withCredentials=true attribute in the CORS request?

---

<div class="post-metadata">

**Author:** ![dev01.ps](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@dev01.ps](https://devforum.okta.com/u/dev01.ps)\
**Post date:** [December 9, 2019, 6:46am UTC](https://devforum.okta.com/t/been-blocked-by-cors-policy-angular/7237/3 "2019-12-09T06:46:28Z")

</div>

I am logged into Okta and after that page is back to angular project i request to getuser data to show the name

here is code

const user = await this.oktaAuth.getUser();

```
   // debugger;
  let userData = this.oktaAuth.getUser().then((user) => {
    debugger;
   this.oktaAuth.getAccessToken().then((token) => {
    // // Got access token
      debugger;
    let httpHeaders: HttpHeaders = new HttpHeaders({ 'Authorization': 'SSWS ' + token })
       .append('Accept', 'application/json').append('Content-Type', 'application/json');

     this.http.get('https://dev-511202.okta.com/api/v1/users/me', { headers: httpHeaders }).subscribe((res) => {
       this.user = res[0].profile.firstName + ' ' + res[0].profile.lastName;
      });
 });
  }); 

```

And it give below error

> **[Screenshot](https://prnt.sc/q84zya)**
>
> Captured with Lightshot

---

<div class="post-metadata">

**Author:** ![dev01.ps](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@dev01.ps](https://devforum.okta.com/u/dev01.ps)\
**Post date:** [December 9, 2019, 10:49am UTC](https://devforum.okta.com/t/been-blocked-by-cors-policy-angular/7237/4 "2019-12-09T10:49:34Z")

</div>

Hello ,

Waiting for the update ?

---

<div class="post-metadata">

**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\
**Post date:** [December 9, 2019, 1:48pm UTC](https://devforum.okta.com/t/been-blocked-by-cors-policy-angular/7237/5 "2019-12-09T13:48:11Z")

</div>

You don’t need to make a request to the /me endpoint yourself. You can use the Angular SDK for that. `this.oktaAuth.getUser()` should return all the same information.

To fix the CORS issues, make sure you have `http://localhost:4200` listed in **API** \> **Trusted Origins**.

---

<div class="post-metadata">

**Author:** ![dev01.ps](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@dev01.ps](https://devforum.okta.com/u/dev01.ps)\
**Post date:** [December 9, 2019, 1:56pm UTC](https://devforum.okta.com/t/been-blocked-by-cors-policy-angular/7237/6 "2019-12-09T13:56:59Z")

</div>

it only return the ‘Sub’

---

<div class="post-metadata">

**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\
**Post date:** [December 9, 2019, 2:44pm UTC](https://devforum.okta.com/t/been-blocked-by-cors-policy-angular/7237/7 "2019-12-09T14:44:52Z")

</div>

Try setting your scopes is set to `openid profile` and see if that helps. From the [docs](https://www.npmjs.com/package/@okta/okta-angular#okta_config):

- `scopes`_(optional)_ : Reserved for custom claims to be returned in the tokens. Defaults to `['openid']` , which will only return the `sub` claim. To obtain more information about the user, use `openid profile` . For a list of scopes and claims, please see [Scope-dependent claims](https://developer.okta.com/standards/OIDC/index.html#scope-dependent-claims-not-always-returned) for more information.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 23, 2024, 7:37pm UTC](https://devforum.okta.com/t/been-blocked-by-cors-policy-angular/7237/8 "2024-01-23T19:37:24Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.