Sometimes Polkadot JS won't connect to the local node, unless I enable rpc-cors all

Question

I am using the polkadot js appimage and sometimes while connecting to my node, I see this : Blocked connection to WebSockets server from untrusted origin: Some("file://"). I've tried running the node with --rpc-cors all and that fixes this issue. Can someone explain why does this fix this issue and what should I be doing to not use this option? All of this is on my local network.

Answer 1

CORS is all about setting up access security across different origins.

By default, external origins do not have access to your blockchain node, and for good reason, they could easily spam your chain with requests and cause bad performance on your server.

Instead, you must enable external origins access to your node with --rpc-cors=all or by giving an explicit list of origins you want to allow access from.

--rpc-cors <ORIGINS>
    Specify browser Origins allowed to access the HTTP & WS RPC servers.
   
    A comma-separated list of origins (protocol://domain or special `null` value). Value of `all` will disable
    origin validation. Default is to allow localhost and <https://polkadot.js.org> origins. When running in
    --dev mode the default is to allow all origins.

Normally, this would not be an issue you run into because if you were running both the web app and the node on the same computer, they share the same origin, so CORS will not even come into play, however you mention an "app image" so maybe you are running your app inside a docker container, and in this case, this looks like a different computer/origin to the node.

If instead, you run everything directly on the same computer, you would not have this problem, otherwise, doing enabling --rpc-cors=all will be fine for your testing here.