I'm having EXTREME difficulty enabling CORS for my .toml file. I've set the home domain of the asset issuing wallet. I do not know where to put the code for enabling CORS, and there is no mention of this in the tutorial. Do I create a new file? What is this file called? I only know html and some javascript.

I would love to complete this asset creation experiment with the stellar.toml tutorial.

closed as off-topic by Bartek Nowotarski, Saya, Francesco, MonsieurNicolas, Synesso Mar 1 '18 at 7:06

  • This question does not appear to be about Stellar, within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    I'm voting to close this question as off-topic because this is general question about configuring web-server/proxy to send CORS headers. – Bartek Nowotarski Feb 13 '18 at 11:14

Apache webserver

Create a .htaccess file in the {your_website_root}/.well-known/ directory.

Header set Access-Control-Allow-Origin "*"

And reload Apache server with apachectl -k graceful command.


Open your config file (usually /etc/nginx/conf.d/{your_domain}.conf), add the following lines into the server directive:

location /.well-known {
   allow all;
   if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' '*';
     add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
     add_header 'Content-Type' 'text/plain; charset=utf-8';
     add_header 'Content-Length' 0;
     return 204;
   if ($request_method = 'GET') {
    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';       
    add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';

Reload Nginx configuration: nginx -s reload.


Create a web.config file in the {your_website_root}/.well-known/ directory with the following content:

<?xml version="1.0" encoding="utf-8"?>
       <add name="Access-Control-Allow-Origin" value="*" />

There is no need to restart a web-server, all changes in web.config automatically reload corresponding application domain.

Using different web-server?

Visit enable-cors.org, locate your web-server in the list and configure it accordingly to the above recommendations.


Enabling CORS will depend on your server environment.

You need to configure your server to return the header: Access-Control-Allow-Origin: *.

So in .Net core it’s done with middleware:


In a Linux environment I believe you can use a .htaccess file with something like:

Header add Access-Control-Allow-Origin "*"

Hope that points you in the right direction.

  • Yes thank you, and I did also ask the question on galatic talk. I wasnt sure which forum was active at the time. Also @orbit lens stellar expert is amazing! – ra333 Feb 15 '18 at 21:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.