Automatic CORS Headers

Every response from your Odoo server automatically includes Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Max-Age headers.

OPTIONS Preflight Handling

Browsers send an OPTIONS request before any cross-origin POST/PUT/DELETE. This module intercepts those preflight requests at the WSGI level and returns a proper 200 OK with all required CORS headers — before Odoo even tries to route them.

Zero Configuration

No settings page, no domain whitelist to maintain, no environment variables. Install the module and CORS is enabled for all origins on all routes immediately.

Works Everywhere

Works on Odoo.sh, self-hosted, and Docker deployments. No nginx config or reverse proxy changes required.
Not compatible with Odoo SaaS (odoo.com) — SaaS does not allow custom modules or server-side patching.

Smart Header Deduplication

If your custom controllers already use Odoo's built-in cors="*" route parameter, the middleware detects existing CORS headers and does not duplicate them.

Health-Check Endpoint

A built-in /cors/health endpoint returns {"status":"ok","cors":"enabled"} — use it from your website JavaScript to verify that CORS is working before making production API calls.

// GET
const res = await fetch('/proxy/myapi/products');

// POST with JSON
const res = await fetch('/proxy/myapi/orders', {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({ item_id: 123, qty: 2 })
});

// DELETE, PUT, PATCH — same pattern
await fetch('/proxy/myapi/orders/456', { method: 'DELETE' });

🛡️ Why this always works

Browser → Odoo (same origin, no CORS check) → External API (server-to-server, no CORS rules). The external server never sees a browser request — it only sees Odoo's Python server. No headers to negotiate, no preflight, no blocked requests. Ever.

// Replace with your Odoo server URL
const ODOO_URL = 'https://your-odoo.com';

// 1. Authenticate (get session cookie)
const auth = await fetch(ODOO_URL + '/web/session/authenticate', {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  credentials: 'include',
  body: JSON.stringify({
    jsonrpc: '2.0',
    params: {
      db:       'your-database',
      login:    'api@example.com',
      password: 'your-api-key'
    }
  })
});

// 2. Fetch products
const products = await fetch(ODOO_URL + '/web/dataset/call_kw', {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  credentials: 'include',
  body: JSON.stringify({
    jsonrpc: '2.0',
    method: 'call',
    params: {
      model:  'product.product',
      method: 'search_read',
      args:   [[]],
      kwargs: {fields: ['name','list_price'], limit: 10}
    }
  })
});

const data = await products.json();
console.log(data.result); // No CORS error!

✅ Proxy in action — external API products loaded through Odoo with zero CORS errors

Does this work on Odoo.sh?

Yes. The module operates entirely within the Odoo Python process — it does not require nginx config, custom Dockerfiles, or SSH access. Just push the module to your Odoo.sh Git repository and install it from the Apps menu.
Not compatible with Odoo SaaS (odoo.com) — SaaS does not allow custom module installation or server-side patching. Use Odoo.sh or self-hosted instead.

Is it safe to allow all origins (*)?

For public APIs and product catalogs, yes. Odoo's own session-based authentication and CSRF protection still apply — CORS headers only tell the browser it's allowed to read the response; they don't bypass login or security rules.

Will it conflict with routes that already have cors="*"?

No. The middleware checks for existing CORS headers before adding its own. If a route already includes Access-Control-Allow-Origin, the module skips that header to avoid duplicates.

How do I uninstall it?

Go to Apps → Installed → CORS & Proxy Manager → Uninstall. After restarting Odoo, the monkey-patch is removed and all responses return to normal Odoo behavior (no CORS headers).

⚠️ cors_allow_origin parameter

Search for cors_allow_origin. Its value must be set to * to allow all origins, or your exact website domain (e.g. https://www.your-site.com).

<div id="product-list"></div>

<script>
fetch('/proxy/destiny/api/v1/web/products')
  .then(r => r.json())
  .then(data => {
    const container = document.getElementById('product-list');
    data.data.forEach(p => {
      container.innerHTML += `
        <div>
          <h3>${p.xdesc}</h3>
          <p>Price: ৳${p.xmrp}</p>
        </div>
      `;
    });
  });
</script>