CORS Error in Figma Plugin Despite Configuring allowedDomains and devAllowedDomains

Hi there,

Thanks for reaching out. I'm checking with our internal team. I will get back to you when I have anything I can share with you. 

Thanks for your patience.

Toku

Hi ​@Jeet Shah, 

Thanks for your patience!

A CORS error indicates that the server that you are making the request to is rejecting the request. To confirm, have you made changes to your backend recently, especially around the Access-Control-Allow-Origin  response header? If so, could you share a bit more details?

Thanks,
Toku

I'm facing that as well. Working nice for a long time. Now i have exactly the same error.

It is failing to access a .js in the same directory at ui.html

Hi ​@Jeet Shah,  it would be best if you could provide the error message for people to help.

But generally here is how it works, networkAccess here is for controlling whether your plugin can make a network request to the certain API or resource.

However, for you to be able to read the response from the API (and not get CORS error), the API must return the appropriate CORS header mentioned by y_toku, which is Access-Control-Allow-Origin.

This is not something controlled via the Figma plugin, but rather by the owner of that API or resource.

tl;dr

networkAccess → allow plugin to send the request

CORS → allow your plugin to read the response

I have similar problem but have not been able to find a solution. I added a local domain like this: 
 

 "networkAccess": {
    "allowedDomains": [
      "https://firebasestorage.googleapis.com",
      "https://......com",
      "https://.....com",
      "https://....app"
    ],
    "reasoning": "Plugin needs to access internal  system",
    "devAllowedDomains": [
      "http://10.35.121.11:13505"
    ]
  },
  "documentAccess": "dynamic-page",
  "permissions": ["currentuser"]
}

But I get:

Invalid value for devAllowedDomains. 'http://10.35.121.11:13505' must be a valid URL.

Also tried without the port. If I add the “*” instead I get the following error: 

Mixed Content: The page at 'https://www.figma.com/design/yyyyy?node-id=0-1&p=f&viewport=-55%2C646%2C1.1&t=SeVR7FP3bKSYCiXf-0' was loaded over HTTPS, but requested an insecure resource 'http://10.35.121.11:13505/api/xxxx'. This request has been blocked; the content must be served over HTTPS.

I am really puzzled on how to use the local private ip as it was clearly document its possible to use http addresses and also we have set up CORS. Any help will be much appreciated.