I am using the polkadot js appimage and sometimes while connecting to my node, I see this : Blocked connection to WebSockets server from untrusted origin: Some("file://"). I've tried running the node with --rpc-cors all and that fixes this issue. Can someone explain why does this fix this issue and what should I be doing to not use this option? All of this is on my local network.

1 Answer 1


CORS is all about setting up access security across different origins.

By default, external origins do not have access to your blockchain node, and for good reason, they could easily spam your chain with requests and cause bad performance on your server.

Instead, you must enable external origins access to your node with --rpc-cors=all or by giving an explicit list of origins you want to allow access from.

--rpc-cors <ORIGINS>
    Specify browser Origins allowed to access the HTTP & WS RPC servers.
    A comma-separated list of origins (protocol://domain or special `null` value). Value of `all` will disable
    origin validation. Default is to allow localhost and <https://polkadot.js.org> origins. When running in
    --dev mode the default is to allow all origins.

Normally, this would not be an issue you run into because if you were running both the web app and the node on the same computer, they share the same origin, so CORS will not even come into play, however you mention an "app image" so maybe you are running your app inside a docker container, and in this case, this looks like a different computer/origin to the node.

If instead, you run everything directly on the same computer, you would not have this problem, otherwise, doing enabling --rpc-cors=all will be fine for your testing here.

  • That seems to clear it up. Yes I am using the app image and the node is running as on a different terminal. When you mention origin or explicitly specifying origins, what would an argument to --rpc-cors look like? Is it a tcp socket or something? I plan on running this on a cloud server soon and would like direct access so I can imagine passing only my origin to it. Mar 2, 2022 at 11:14
  • 1
    I added the --help command for --rpc-cors above. You provide a comma separated list like --rpc-cors=https://mywebsite.com,https://myothersite.com
    – Shawn Tabrizi
    Mar 2, 2022 at 11:39
  • that's very useful. Thanks shawn! Mar 2, 2022 at 11:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.