CORS xano issues with the new weweb environment

Ask us anything
1

I got the email to update my whitelist domains, and to use a wildcard. However, Xano’s CORS management doesn’t support a * wildcard inside a domain.

I’ve tried several things - adding the full subdomain uuid from my editor address bar to the allow list, and adding things like editor-cdn.weweb.io to the list since that’s what the error says the request comes from, but nothing helps aside from turning CORS off all together which is not something I intend to do.

How has anyone else fixed this? I’ve already lost half a workday due to a stupid change and getting really frustrated with this.

Solved: removed the / at the end of the domain

2

hey Niels,

have you set headers?

3

Hi Batik,

Thanks for your reply!

Yes for certain API groups I use headers accessToken, Content-Type, Authorization, X-Requested-With, X-Data-Source, X-Branch

The thing is, it worked fine until weweb changed the editor url from editor.weweb.io/* to *-editor.weweb.io

Because the origins in xano don’t support the * wildcard. So editor.weweb.io/ would work and would allow anything after the / but the new subdomain structure isn’t supported by xano in that way, it seems

4

hmm, that sounds strange.

Xano team confirmed wildcard support:

5

It seems that in the reponses of that topic, the person also says it doesn’t work for him.

I’ve tried all of these variations but none work:

Screenshot 2026-04-16 at 14.23.41
Screenshot 2026-04-16 at 14.23.411804×2070 230 KB

As soon as I allow everything though, I get the data into weweb:

Screenshot 2026-04-16 at 14.23.46
Screenshot 2026-04-16 at 14.23.461774×572 35.4 KB

6

hm, are you sure that headers may be set in one comma-separated line? Have you tried to set each header in the separate field?

image
image895×144 11.6 KB

I don’t use CORS in Xano, but I use it with S3 storage. And the following works for me:
image

7

Yes because those header settings work before the domain changed. In fact, it still works on the published site, which is why I was pretty sure the problem wasn’t in the headers.

I just discovered the problem is in having a / in the end of the url!

Thanks for thinking along with me!

1 Like
8

I’m glad the case is solved

2 Likes
9

Oh wow, I wouldn’t have thought to check that!

Thanks for taking the time to share the solution on here, really appreciate it!

10

Don’t know if it is specifically related to CORS, but the new update did make any Xano calls where I added custom header parameters (eg. source page name) stopped working. I had to remove these parameters for the calls to work again.

11

@nealzie - Check this out New version - Error on Xano plugin requests - #11 by RandyG0322 .

Update: disregard-- I see you figured it out.. That was my issue as well :wink: . Glad you got it figured out

1 Like