CORS Error when Creating Store from Local Playground (localhost:3000)

[tanvir1017]

I'm experiencing CORS errors when trying to create a store from the OpenFGA Playground running locally on port 3000. The Playground UI makes requests to the API on port 8080, but these requests are being blocked by CORS policy despite having CORS configuration enabled.

Environment

• OpenFGA Version: Latest (from openfga/openfga:latest)
• Deployment: Docker Compose with PostgreSQL
• Browsers Tested: Brave, Chrome (both showing same issue)
• Operating System: Previously worked on Ubuntu with browser switch, now failing on current system

Steps to Reproduce

1. Start services using the provided docker-compose.yml
2. Access Playground at http://localhost:3000/playground
3. Attempt to create a store
4. Observe CORS error in browser console

    *docker-compose.yml*

        networks:
          openfga:
        
        services:
          postgres:
            image: postgres:17
            container_name: postgres
            networks:
              - openfga
            ports:
              - "5432:5432"
            environment:
              - POSTGRES_USER=postgres
              - POSTGRES_PASSWORD=password
              - POSTGRES_DB=openfga
            healthcheck:
              test: ["CMD-SHELL", "pg_isready -U postgres"]
              interval: 5s
              timeout: 5s
              retries: 5
            volumes:
              - postgres_data:/var/lib/postgresql/data
        
          pgadmin:
            image: dpage/pgadmin4
            container_name: pgadmin
            environment:
              - PGADMIN_DEFAULT_EMAIL=admin@example.com
              - PGADMIN_DEFAULT_PASSWORD=admin
            ports:
              - "5050:80"
            networks:
              - openfga
            depends_on:
              - postgres
        
          openfga:
            depends_on:
              migrate:
                condition: service_completed_successfully
            image: openfga/openfga:latest
            container_name: openfga
            environment:
              - OPENFGA_DATASTORE_ENGINE=postgres
              - OPENFGA_DATASTORE_URI=postgres://postgres:password@postgres:5432/openfga?sslmode=disable
              - OPENFGA_LOG_FORMAT=json
              - OPENFGA_PLAYGROUND_ENABLED=true
              - OPENFGA_HTTP_CORS_ENABLED=true
              - OPENFGA_HTTP_CORS_ALLOWED_ORIGINS=http://localhost:3000,https://play.fga.dev
              - OPENFGA_HTTP_CORS_ALLOWED_HEADERS=*
              - OPENFGA_HTTP_CORS_ALLOWED_METHODS=GET,POST,PUT,PATCH,DELETE,OPTIONS
            command: run
            networks:
              - openfga
            ports:
              - "8080:8080"
              - "8081:8081"
              - "3000:3000"
        
          migrate:
            depends_on:
              postgres:
                condition: service_healthy
            image: openfga/openfga:latest
            container_name: migrate
            command: migrate
            environment:
              - OPENFGA_DATASTORE_ENGINE=postgres
              - OPENFGA_DATASTORE_URI=postgres://postgres:password@postgres:5432/postgres?sslmode=disable
            networks:
              - openfga
        
        volumes:
          postgres_data:
          

From browswer console

Request URL
http://127.0.0.1:8080/stores
Referrer Policy
origin-when-cross-origin
accept
application/json, text/plain, */*
content-type
application/json
referer
https://play.fga.dev/
sec-ch-ua
"Chromium";v="142", "Google Chrome";v="142", "Not_A Brand";v="99"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

[tanvir1017]

Also in my console:

[iyashjayesh]

@tanvir1017 I figured out a way. Start the server and try with bellow url for now. Let me know if you find any solution!

https://play.fga.dev/sandbox/?fga_api_host=127.0.0.1%3A8080&fga_api_scheme=http&fga_api_token=&store=

[hugoewarrior]

The workaround from @iyashjayesh actually worked!

Thanks!

[dyeam0]

Thanks @iyashjayesh! Here is another another workaround that has worked. It is posted in this GH issue: openfga/openfga#338 (comment).

BTW, it wasn't a change in OpenFGA that has recently caused the issue, it is Google’s security tightening in Chrome. See this announcement: https://developer.chrome.com/blog/pna-permission-prompt-ot-end

[iyashjayesh]

Ah got it, thanks @dyeam0

[lazee]

Worked out of the box for me with Firefox...