CROSS ORIGIN Request In Thingworx

[TW_10599876]

We can allow other IPs to use the ThingWorx REST API by enabling cross-origin access. I tried modifying the web.xml file, but I couldn't get it to work. Can anyone help me?

[Rocko]

Thingworx REST API is open to anyone to be used. CORS is a browser concept, not on the HTTP level where REST API works.

You will need an application key to get access, and this application key supports IP whitelisting, but it's not populated by default, which means if you don't fill in an IP (list), anyone can access.

So if you have issues accessing with an appkey, check the app key if that field is populated.

[TW_10599876]

I am using a web application that I developed to query the ThingWorx API and display the data on my web page. This is causing the issue. Is there a way to fix it?

[TonyZhang]

Hi @TW_10599876,

What ThingWorx API are you querying?

What is the exact issue you have observed when querying the API? Could you please provide some screenshots to elaborate?

[TW_10599876]

I'm going to fetch data from the ThingWorx API using this reference: https://support.ptc.com/help/thingworx/platform/r9.6/en/index.html#page/ThingWorx/Help/REST_API/ThingWorxRESTAPI.html

. I'll be retrieving values from parameters or various services in a Thing.

I'm fetching the data from my web app, which is built with React, using the fetch API to request data from the ThingWorx API server.

[TW_10599876]

The issue I'm facing is that when I query the ThingWorx API from my web application through a web browser, I encounter a CORS (Cross-Origin Resource Sharing) restriction from ThingWorx. However, when I query the API locally, it works without any issues.

[TonyZhang]

Can you please share the web.xml and maybe some screenshots of the error and relevant code as mentioned by @nmutter?

Also, you can debug CORS issue with the browser dev tool as mentioned in the 6 point of CORS Errors Demystified: How to Fix Cross-Origin Issues 

And also check out this one where some other methods to address this issue are introduced.

[nmutter]

There is this article which I successfully used to allow CORS before: https://www.ptc.com/en/support/article/CS229450

Make sure to follow it completely as there are items like `As of ThingWorx Platform 8.5 and up, it is also necessary to...` which also need to be done if applicable

[TW_10599876]

I'm using ThingWorx version 9.3.4. I've tried configuring it according to various forum discussions, but the issue persists.

[nmutter]

I did not have an issue hm. You did restart Tomcat after editing the file I bet?

Not so sure if the file contains any 'secrets' but maybe you want to share it with us? Best would be original version and modified on. But make sure nothing confidential is in it. I am not sure...

Could you also share the exact error you get? With censored domain names. (just to double check its not mixed content error or something ;))