# CORS Issue with Local Nakama Server and Unity WebGL(HTTP)

**URL:** https://forum.heroiclabs.com/t/cors-issue-with-local-nakama-server-and-unity-webgl-http/5376
**Category:** Local Setup
**Tags:** sdk-unity, authentication
**Created:** [June 20, 2024, 6:52am UTC](https://forum.heroiclabs.com/t/cors-issue-with-local-nakama-server-and-unity-webgl-http/5376 "2024-06-20T06:52:23Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![steven060594](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.heroiclabs.com/steven060594/32/1528_2.png) [@steven060594](https://forum.heroiclabs.com/u/steven060594)
#### Post date: [June 20, 2024, 6:52am UTC](https://forum.heroiclabs.com/t/cors-issue-with-local-nakama-server-and-unity-webgl-http/5376/1 "2024-06-20T06:52:23Z")

</div>

Hello,

I have trouble with CORS when authenticating to get a session with the Nakama server running on localhost.

Is it possible to fix this issue without HTTPS?

Thank you!

{Details}

- Unity WebGL game is hosted on EC2 (HTTP).
- Nakama server is running locally (HTTP).

```auto
        private async UniTask ConnectAsync(string scheme, string host, int port, string serverKey)
        {
            //WebGL 가이드 - https://github.com/heroiclabs/nakama-unity?tab=readme-ov-file 참고
#if UNITY_WEBGL && !UNITY_EDITOR
            IClient client = new Client(scheme, host, port, serverKey, UnityWebRequestAdapter.Instance);
#else
            IClient client = new Client(scheme, host, port, serverKey);
#endif
            ISocket socket = client.NewSocket(useMainThread: true);

            string deviceId = PlayerPrefs.GetString(NakamaConstants.DeviceIdKey);

            if (string.IsNullOrWhiteSpace(deviceId))
            {
                deviceId = Guid.NewGuid().ToString();
            }

            ISession session = await AuthenticateDeviceId(client, deviceId);

            IApiAccount account = null;
            account = await client.GetAccountAsync(session);

            _connection.Init(client, socket, session, account);

            await socket.ConnectAsync(session);
        }

        private async UniTask<ISession> AuthenticateDeviceId(IClient client, string deviceId)
        {
            string authToken = PlayerPrefs.GetString(NakamaConstants.AuthTokenKey, null);
            string refreshToken = PlayerPrefs.GetString(NakamaConstants.RefreshTokenKey, null);

            ISession session = null;

            if (!string.IsNullOrEmpty(authToken))
            {
                session = Session.Restore(authToken, refreshToken);

                if (session.HasExpired(DateTime.UtcNow.AddDays(1)))
                {
                    try
                    {
                        session = await client.SessionRefreshAsync(session);
                    }
                    catch (ApiResponseException ex)
                    {
                        Log.ErrorFormat("Failed to refresh session: {0}. Try to get a new refresh token.", ex);
                        session = await client.AuthenticateDeviceAsync(deviceId);
                        PlayerPrefs.SetString(NakamaConstants.RefreshTokenKey, session.RefreshToken);
                    }

                    PlayerPrefs.SetString(NakamaConstants.AuthTokenKey, session.AuthToken);
                }
            }
            else
            {
                session = await client.AuthenticateDeviceAsync(deviceId);
                PlayerPrefs.SetString(NakamaConstants.AuthTokenKey, session.AuthToken);
                PlayerPrefs.SetString(NakamaConstants.RefreshTokenKey, session.RefreshToken);
            }

            return session;
        }

```

```auto
Access to fetch at 'http://127.0.0.1:7350/v2/account/authenticate/device?create=true&' 
from origin 'http://{my_ip}:{port}' has been blocked by CORS policy: 
The request client is not a secure context and the resource is in more-private address space `local`.

```

---

<div class="post-metadata">

### Author: ![steven060594](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.heroiclabs.com/steven060594/32/1528_2.png) [@steven060594](https://forum.heroiclabs.com/u/steven060594)
#### Post date: [June 24, 2024, 6:36am UTC](https://forum.heroiclabs.com/t/cors-issue-with-local-nakama-server-and-unity-webgl-http/5376/2 "2024-06-24T06:36:53Z")

</div>

OK, I found that this issue is about the ‘Private Network Access (PNA)’ CORS error.

- [Private Network Access: introducing preflights &nbsp;|&nbsp; Blog &nbsp;|&nbsp; Chrome for Developers](https://developer.chrome.com/blog/private-network-access-preflight)

So I published my WebGL app over HTTPS, and I could solve the problem.