Gophish API 请求被阻止：“不允许标头‘授权’”（Javascript 请求）

Question

I am using the Gophish API for the first time.

I can't get the list of the sending profiles through a simple Javascript HTTP request. Firefox display this error message:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at
``https://MY_GOPHISH_SERVER_URL:3333/api/smtp``. (Reason: header ‘authorization’ is not allowed according to header  ‘Access-Control-Allow-Headers’ from CORS preflight response).

Here is my request code:

fetch("MY_GOPHISH_SERVER_URL:3333/api/smtp", {
        method: "GET",
        headers: {
            Authorization : MY_GOPHISH_API_KEY
        },
    })
    .then(response => response.json())
    .then(data => console.log(data))
    .catch(error => console.error(error.message))
}

What could I try? Is there a way to edit Gophish CORS policy?

Thanks.

Julien

Additional information:

• The campaigns made from Gophish browser interface work well.
• If I try the same request with POSTMAN, it works only if I disable the SSL certificate verification.
• The SSL certificate is valid (I own it and it is announced as valid by browsers)

Answer 1

I actually discovered that it requires to disable the SSL certificate verification as the SSL certificate is known and valid.

I am gonna open a new ticket for that purpose as it is bugging as well... xD !