Automatic CORS Headers

Every response from your Odoo server automatically includes Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Max-Age headers.

OPTIONS Preflight Handling

Browsers send an OPTIONS request before any cross-origin POST/PUT/DELETE. This module intercepts those preflight requests at the WSGI level and returns a proper 200 OK with all required CORS headers — before Odoo even tries to route them.

Zero Configuration

No settings page, no domain whitelist to maintain, no environment variables. Install the module and CORS is enabled for all origins on all routes immediately.

Works Everywhere

Works on Odoo.sh, self-hosted, and Docker deployments. No nginx config or reverse proxy changes required.
Not compatible with Odoo SaaS (odoo.com) — SaaS does not allow custom modules or server-side patching.

Smart Header Deduplication

If your custom controllers already use Odoo's built-in cors="*" route parameter, the middleware detects existing CORS headers and does not duplicate them.

Health-Check Endpoint

A built-in /cors/health endpoint returns {"status":"ok","cors":"enabled"} — use it from your website JavaScript to verify that CORS is working before making production API calls.

// GET
const res = await fetch('/proxy/myapi/products');

// POST with JSON
const res = await fetch('/proxy/myapi/orders', {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({ item_id: 123, qty: 2 })
});

// DELETE, PUT, PATCH — same pattern
await fetch('/proxy/myapi/orders/456', { method: 'DELETE' });

🛡️ Why this always works

Browser → Odoo (same origin, no CORS check) → External API (server-to-server, no CORS rules). The external server never sees a browser request — it only sees Odoo's Python server. No headers to negotiate, no preflight, no blocked requests. Ever.

// ------- Configure in Odoo UI first: -------
// CORS & Proxy Manager → Proxy Servers → New
//   Label:        My Weather API
//   Base URL:     https://api.weatherapi.com
//   Route Prefix: /proxy/weather
// --------------------------------------------

// Now call from your Odoo website — zero CORS errors:
const res = await fetch('/proxy/weather/v1/current.json?key=YOUR_KEY&q=Dhaka');
const weather = await res.json();
console.log(weather.current.temp_c); // 🌡️ temperature from external API!

// Works the same way for ANY API:
// Payment gateway:  /proxy/payment/charge
// Inventory system: /proxy/inventory/stock
// Public dataset:   /proxy/data/records
// Your own API:     /proxy/myservice/endpoint

✅ Works with any external website or API — not just Odoo. Configure as many proxy servers as you need from the Odoo UI. No code changes required.

// Replace with your Odoo server URL
const ODOO_URL = 'https://your-odoo.com';

// 1. Authenticate (get session cookie)
const auth = await fetch(ODOO_URL + '/web/session/authenticate', {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  credentials: 'include',
  body: JSON.stringify({
    jsonrpc: '2.0',
    params: { db: 'your-database', login: 'api@example.com', password: 'your-api-key' }
  })
});

// 2. Fetch any Odoo model
const res = await fetch(ODOO_URL + '/web/dataset/call_kw', {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  credentials: 'include',
  body: JSON.stringify({
    jsonrpc: '2.0', method: 'call',
    params: {
      model: 'product.product', method: 'search_read',
      args: [[]], kwargs: {fields: ['name','list_price'], limit: 10}
    }
  })
});
const data = await res.json();
console.log(data.result); // No CORS error!

✅ Proxy in action — external API products loaded through Odoo with zero CORS errors

Does this work on Odoo.sh?

Yes. The module operates entirely within the Odoo Python process — it does not require nginx config, custom Dockerfiles, or SSH access. Just push the module to your Odoo.sh Git repository and install it from the Apps menu.
Not compatible with Odoo SaaS (odoo.com) — SaaS does not allow custom module installation or server-side patching. Use Odoo.sh or self-hosted instead.

Does the proxy work for any third-party API?

Yes. The proxy acts as a relay over backend HTTP connections, meaning it is not subject to browser CORS policies. You can safely map to weather APIs, suppliers, inventory metrics or any webhook endpoints.

Is it safe to allow all origins (*) in the settings?

If you are only using the proxy server to fetch data from third party websites, you don't even need to configure origins. If you are also letting external sites access Odoo APIs, then allowing `*` is fine for public catalogs. Odoo's own session-based authentication and CSRF protection still apply to private requests.

Will it conflict with routes that already have cors="*"?

No. The middleware checks for existing CORS headers before adding its own. If a route already includes Access-Control-Allow-Origin, the module skips that header to avoid duplicates.

How do I uninstall it?

Go to Apps → Installed → CORS & Proxy Manager → Uninstall. After restarting Odoo, the monkey-patch is removed and all responses return to normal Odoo behavior (no CORS headers).

⚠️ cors_allow_origin parameter (Optional, for outbound Odoo APIs)

Search for cors_allow_origin. Its value must be set to * to allow all origins, or your exact allowed external domain (e.g. https://www.your-external-site.com).

<div id="product-list"></div>

<script>
fetch('/proxy/destiny/api/v1/web/products')
  .then(r => r.json())
  .then(data => {
    const container = document.getElementById('product-list');
    data.data.forEach(p => {
      container.innerHTML += `
        <div>
          <h3>${p.xdesc}</h3>
          <p>Price: ৳${p.xmrp}</p>
        </div>
      `;
    });
  });
</script>