I'm having EXTREME difficulty enabling CORS for my .toml file. I've set the home domain of the asset issuing wallet. I do not know where to put the code for enabling CORS, and there is no mention of this in the tutorial. Do I create a new file? What is this file called? I only know html and some javascript.

I would love to complete this asset creation experiment with the stellar.toml tutorial.

  • 4
    I'm voting to close this question as off-topic because this is general question about configuring web-server/proxy to send CORS headers. Feb 13, 2018 at 11:14

2 Answers 2


Apache webserver

Create a .htaccess file in the {your_website_root}/.well-known/ directory.

Header set Access-Control-Allow-Origin "*"

And reload Apache server with apachectl -k graceful command.


Open your config file (usually /etc/nginx/conf.d/{your_domain}.conf), add the following lines into the server directive:

location /.well-known {
   allow all;
   if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' '*';
     add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
     add_header 'Content-Type' 'text/plain; charset=utf-8';
     add_header 'Content-Length' 0;
     return 204;
   if ($request_method = 'GET') {
    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';       
    add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';

Reload Nginx configuration: nginx -s reload.


Create a web.config file in the {your_website_root}/.well-known/ directory with the following content:

<?xml version="1.0" encoding="utf-8"?>
       <add name="Access-Control-Allow-Origin" value="*" />

There is no need to restart a web-server, all changes in web.config automatically reload corresponding application domain.

Using different web-server?

Visit enable-cors.org, locate your web-server in the list and configure it accordingly to the above recommendations.


Enabling CORS will depend on your server environment.

You need to configure your server to return the header: Access-Control-Allow-Origin: *.

So in .Net core it’s done with middleware:


In a Linux environment I believe you can use a .htaccess file with something like:

Header add Access-Control-Allow-Origin "*"

Hope that points you in the right direction.


Not the answer you're looking for? Browse other questions tagged or ask your own question.