CORS Issue in Marketplace after Upgrading to Confluence Data Center 7.4.14
Asked by William Yeack:

After upgrading my Confluence Data Center instance to 7.4.14, I am getting CORS errors on the "Manage apps" screen when expanding some of the plugins on my instance. You can see the issue here:

<https://www.screencast.com/t/fXA565cj>

As you can see, it looks like a request is getting blocked from the following URL:

```
https://marketplace.atlassian.com/rest/2/addons/com.adaptavist.confluence.contentFormattingMacros/pricing/server/live?countryCode=FI
```

I have already tried adding a whitelist for the marketplace.atlassian.com domain, which you can see here:

![Img1.jpg](/t5/image/serverpage/image-id/174502i28B5E500D3F054CC/image-size/large?v=v2&px=999 "Img1.jpg")

I have also added the following the following modification to the web.xml file (as suggested [here](https://confluence.atlassian.com/confkb/getting-cors-errors-when-accessing-confluence-resources-1005806356.html)):

```
<!-- MBZ: Added CORS Headers -->
<filter>
<filter-name>CorsFilter</filter-name>
<filter-class>org.apache.catalina.filters.CorsFilter</filter-class>;
<init-param>
<param-name>cors.allowed.origins</param-name>
<param-value>https://www.atlassian.com,https://marketplace.atlassian.com,https://support.member.buzz,https://www.member.buzz,https://resources.member.buzz,https://files.member.buzz</param-value>
</init-param>
<init-param>
<param-name>cors.allowed.methods</param-name>
<param-value>GET,POST,PUT,DELETE</param-value>
</init-param>
<init-param>
<param-name>cors.exposed.headers</param-name>
<param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
</init-param>
<init-param>
<param-name>cors.support.credentials</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>cors.preflight.maxage</param-name>
<param-value>1800</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>CorsFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
```


Answers:
author: Sundar Radhakrishnan
body: [@William Yeack](/t5/user/viewprofilepage/user-id/518819) Try unchecking the setting "Connect to the Atlassian Marketplace" on the Manage Apps page.

![Screen Shot 2021-12-17 at 1.58.09 PM.png](https://community.atlassian.com/t5/image/serverpage/image-id/174516iF1122E64A3905E4E/image-size/large?v=v2&px=999 "Screen Shot 2021-12-17 at 1.58.09 PM.png")

comments: author: William Yeack
body: Hi [@Sundar Radhakrishnan](/t5/user/viewprofilepage/user-id/3658817) - so I went back to check and the problem seems to have been resolved. I am guessing that the Atlassian wasn't giving the right headers on their side and then they fixed things?


author: Sundar Radhakrishnan
body: [@William Yeack](/t5/user/viewprofilepage/user-id/518819) Looks like that. When I was facing the same issue this morning EST, saw errors on the browsers' console related to CORS when our local Jira app was calling marketplace API to fetch the plugin's info.So, they could have added XSS related headers in the response and set it to block. Or they would've enabled CORS at their backend (API or at the firewall side) and removed it.


Tags: app

atlassian-marketplace

confluence-server

cross-origin

server