I tested with Advanced REST client (chrome extension) and ncat, but no Access-Control-Allow-Origin is present. I launched first with the command line with various syntaxes and parameters for --rpccorsdomain. Then I tried within the ipc console things like admin.startRPC("", 8545, "*") (or other domains).

Anyway, this is my test request :


HOST: rpc.wesen.fr:8545
content-type: application/json
accept-encoding: gzip
content-length: 58


And the response headers :

Content-Type: application/json
Vary: Origin
Date: Sat, 10 Dec 2016 22:23:52 GMT
Content-Length: 39

with the data :


which is correct.

This is my configuration : (linux is arch)

Version: 1.5.4-stable
Protocol Versions: [63 62]
Network Id: 1
Go Version: go1.7.3
OS: linux

2 Answers 2


such header exists :

run geth with specific domaine --rpccorsdomain "test.com" or with '*'

then try

 curl -D - -H 'Origin: test.com' http://localhost:8545

you'll get :

HTTP/1.1 200 OK
Access-Control-Allow-Origin: test.com
Content-Type: application/json
Vary: Origin
Date: Sun, 11 Dec 2016 09:56:06 GMT
Content-Length: 58


if you make an error in the origin you will not get an indication of the Access-Control-Allow-Origin.

for more detail look into the go code , func newCorsHandler(srv *Server, corsString string) where allowedOrigins is defined.

  • Thank you ! I did read the go code, but did not try to send an Origin header. I do not understand why the host one is not enough.
    – Labo
    Dec 11, 2016 at 11:49

Since I had to find a solution quickly, and I already was using ncat to serve over SSL, there is a hotfix (I removed the options about https, but it works with SSL since I only modify the output of the wrapped command with sed):

sudo ncat -lk -p 443 --sh-exec "ncat 8545 | sed -u '/^Date: /aAccess-Control-Allow-Origin: *'"

(if you use another port, you won't need to sudo)

If you are not familiar with GNU sed, -u is the unbuffered mode to avoid latency, and the command just adds a line with the CORS policy after the Date: header. In the general case, you should use '0,/^Date: /aAccess-Control-Allow-Origin: *' to replace only the first occurence, but here geth will never begin another line with Date:.

Obviously you can use any other domain or list of domains. I hope this will be useful, but I do not consider it a valid answer to the question which is "why?".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.