If JavaScript on your Odoo website calls an external API, the browser often blocks it with a CORS error. Odoo CORS & Proxy Manager fixes this in two ways: a server-side proxy, so your page calls a path on your own Odoo domain and Odoo fetches the external API, and automatic CORS headers, so other websites can call your Odoo APIs. Both work without nginx changes.
At a glance
| Module | Odoo CORS & Proxy Manager |
|---|---|
| Odoo version | 19 (18 also available) |
| Hosting | Odoo.sh, self-hosted, Docker (not Odoo Online) |
| Publisher | Dot BD Solutions Limited |
| Developer | Rafiur Rahman Rafit |
Why the CORS error happens
Browsers follow the same-origin policy. When a page on www.your-domain.com fetches api.some-service.com and that API does not send an Access-Control-Allow-Origin header for your domain, the browser blocks the response. You see "has been blocked by CORS policy" in the console.
Fix 1: the server-side proxy (recommended)
You define a proxy route in Odoo, for example /proxy/weather pointing to https://api.weatherapi.com. Your page then calls /proxy/weather/v1/current.json. That is your own domain, so the browser allows it, and Odoo fetches the external API server to server, where CORS does not apply.
- Add a proxy server: CORS & Proxy Manager > Proxy Servers > New, with a label, the base URL and a route prefix.
- Call it from your page: use the route prefix in fetch(), with GET, POST, PUT, PATCH or DELETE.
Fix 2: CORS headers for your Odoo APIs
If a separate website or app needs to call Odoo directly, the module adds the CORS headers to Odoo's responses and answers browser preflight (OPTIONS) requests. Set the allowed origin in the cors_allow_origin system parameter. Routes that already set CORS headers are left alone, so headers are never duplicated.
Common uses
- Showing currency rates, weather, supplier stock or shipment tracking on an Odoo website.
- Widgets on WordPress, Shopify or Wix that read data from Odoo.
- React, Vue or Angular front ends that use Odoo as the backend.
- Progressive web apps and dashboards.
A health-check endpoint, /cors/health, confirms the module is active.
Frequently asked questions
Does it work on Odoo.sh?
Yes. It runs inside the Odoo process, so no nginx or server access is needed. It does not work on Odoo Online, which does not allow custom modules.
Is allowing all origins safe?
For the proxy you don't need to set origins at all. If you open Odoo APIs to other sites, Odoo's session login and CSRF protection still apply; restrict origins to your own domains for private data.
How do I remove it?
Uninstall it from Apps and restart Odoo. Responses go back to normal.
Stuck on a CORS error?
Send me the console error and the API you're calling, and I'll tell you which fix you need.
