Skip to content

Upcoming Change in 23.0.0: IO-Proxy Restricts Cross-Origin Requests

Change

Starting in Flywheel 23.0.0, IO-Proxy enforces a stricter cross-origin resource sharing (CORS) policy by default. IO-Proxy is the Flywheel service that answers requests to the /io-proxy endpoints of your site.

A cross-origin request is a request that a browser-based application sends to your Flywheel site from a different web address, or origin. Before 23.0.0, IO-Proxy accepts cross-origin requests from any origin. Starting in 23.0.0, IO-Proxy accepts cross-origin requests only from origins on your site's allow list. Web browsers block requests from any other origin.

By default, the allow list contains:

  • Your Flywheel site's own origin, such as https://your-site.flywheel.io
  • The Flywheel content delivery network (CDN), https://cdn.flywheel.io

Purpose

Flywheel is making this change as part of ongoing security hardening. A policy that accepts requests from any origin allows a web page on an untrusted site to send requests to IO-Proxy from a signed-in user's browser. Restricting cross-origin requests to trusted origins closes this gap.

Not Affected

The following are not affected:

  • The Flywheel web application and the viewers that Flywheel provides
  • Extension applications hosted on your Flywheel site or on cdn.flywheel.io
  • Scripts, gears, and command-line tools that call IO-Proxy outside a web browser, such as curl commands or Python scripts. Web browsers enforce CORS, so it does not apply to requests sent by other clients.

Who Is Affected

Browser-based applications that send requests directly to IO-Proxy from an origin other than your Flywheel site or cdn.flywheel.io. Common examples include:

  • Extension applications hosted on your own web server or a third-party hosting service
  • Custom web applications or dashboards that load data from IO-Proxy
  • Applications under development that run on a local development server, such as http://localhost:3000

After your site upgrades to 23.0.0, the browser blocks these requests unless the application's origin is on your site's allow list. The browser console reports the blocked requests as CORS errors.

Before your site upgrades to Flywheel 23.0.0:

  1. Identify any browser-based applications that send requests to IO-Proxy from an origin other than your Flywheel site or cdn.flywheel.io.
  2. List the origin of each application. An origin includes the scheme (http or https), the host name, and any non-standard port. For example, https://apps.example.com and http://localhost:3000 are two different origins.
  3. Contact Flywheel Support and ask to add these origins to your site's IO-Proxy allow list.