title: CORS with Aurelia-CLI server
body: <p><strong>Updated solution and history of problem</strong></p>
  
  <p>My setup is like this:</p>
  
  <p><a href="https://i.stack.imgur.com/kywL7.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/kywL7.png" alt="setup"></a></p>
  
  <p>I had CORS understood the wrong way around, thinking that the HTTP server should serve the headers. The fact is that it is the 3rd party API which needs to supply CORS headers.</p>
  
  <p>As the 3rd party doesn't send CORS headers, and <code>fetch client</code> expects those (to get around same-origin policy of browsers) an error message like this appears:</p>
  
  <blockquote>
    <p>Fetch API cannot load <a href="http://api.sl.se/api2/realtimedeparturesV4.json?key=b99d17e1714142ca90ed017aeead32fc&amp;siteid=9001" rel="nofollow noreferrer">http://api.sl.se/api2/realtimedeparturesV4.json?key=b99d17e1714142ca90ed017aeead32fc&amp;siteid=9001</a>. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '<a href="http://localhost:9000" rel="nofollow noreferrer">http://localhost:9000</a>' is therefore not allowed access.</p>
  </blockquote>
  
  <p>Now, there are possibilities to turn of CORS in the fetch client with <code>{mode: 'no-cors'}</code>, but that prohibits JavaScript (unless response is plain text).</p>
  
  <p>The solution, I chose is to implement a proxy on the server-side (for simplicity: same domain as the Aurelia page is served from) which then calls the 3rd party. Server-side doesn't have CORS restrictions.</p>
  
  <p>A better solution would be that the 3rd party supported CORS, but sometimes this is not an option (i.e. 3rd party).</p>