# No 'Access-Control-Allow-Origin' header error on embed **URL:** \ **Category:** Spaces\ **Created:** [October 25, 2022, 6:29pm UTC](https://discuss.huggingface.co/t/no-access-control-allow-origin-header-error-on-embed/24964 "2022-10-25T18:29:40Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![greendra](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/greendra/32/46012_2.png) [@greendra](https://discuss.huggingface.co/u/greendra)\ **Post date:** [October 25, 2022, 6:29pm UTC](https://discuss.huggingface.co/t/no-access-control-allow-origin-header-error-on-embed/24964/1 "2022-10-25T18:29:41Z")
Got a site in production with demos embeded from Huggingface Spaces. Today, they are all getting this error and no users can access the demos. Site is hosted on Github Pages, as suggested in Docs. `Access to fetch at 'https://greendra-3253423.hf.space/config' (redirected from 'https://hf.space/embed/greendra/3253423/+/config') from origin 'http:urlredacted.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.` Please look into this as it breaks all my projects. Iframe embed returns 404 message on mobile devices. Thank you. ---
**Author:** ![greendra](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/greendra/32/46012_2.png) [@greendra](https://discuss.huggingface.co/u/greendra)\ **Post date:** [October 25, 2022, 6:51pm UTC](https://discuss.huggingface.co/t/no-access-control-allow-origin-header-error-on-embed/24964/2 "2022-10-25T18:51:58Z")
newly created spaces do not have this issue. seems to only impact my old spaces? have migrated spaces for the time being, but would still like to know why this happens! ---
**Author:** ![freddyaboulton](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/freddyaboulton/32/32732_2.png) [@freddyaboulton](https://discuss.huggingface.co/u/freddyaboulton)\ **Post date:** [October 25, 2022, 7:07pm UTC](https://discuss.huggingface.co/t/no-access-control-allow-origin-header-error-on-embed/24964/3 "2022-10-25T19:07:02Z")
There were some changes to the infrastructure serving gradio spaces today! You should also change the url to `https://${org-name}-{space-name}.hf.space/` ---
**Author:** ![greendra](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/greendra/32/46012_2.png) [@greendra](https://discuss.huggingface.co/u/greendra)\ **Post date:** [October 25, 2022, 7:20pm UTC](https://discuss.huggingface.co/t/no-access-control-allow-origin-header-error-on-embed/24964/4 "2022-10-25T19:20:35Z")
Currently using the following. How should this be adapted? `` Seems crazy an update was pushed which breaks implementations on older versions? And no warning or documentation update to go with it? Or have I missed something. ---
**Author:** ![abidlabs](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/abidlabs/32/21878_2.png) [@abidlabs](https://discuss.huggingface.co/u/abidlabs)\ **Post date:** [October 25, 2022, 7:38pm UTC](https://discuss.huggingface.co/t/no-access-control-allow-origin-header-error-on-embed/24964/5 "2022-10-25T19:38:30Z")
Hmm @greendra is the Space you are trying to embed a private Space or a public Space? If it’s a public Space, can you link it here? ---
**Author:** ![greendra](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/greendra/32/46012_2.png) [@greendra](https://discuss.huggingface.co/u/greendra)\ **Post date:** [October 25, 2022, 7:50pm UTC](https://discuss.huggingface.co/t/no-access-control-allow-origin-header-error-on-embed/24964/6 "2022-10-25T19:50:01Z")
Public spaces appear to be working for me. Is there a solution for private ones? ---
**Author:** ![abidlabs](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/abidlabs/32/21878_2.png) [@abidlabs](https://discuss.huggingface.co/u/abidlabs)\ **Post date:** [October 25, 2022, 7:58pm UTC](https://discuss.huggingface.co/t/no-access-control-allow-origin-header-error-on-embed/24964/7 "2022-10-25T19:58:05Z")
Hi @greendra can you share more about how come you’d like to embed a Space but keep in private? It feels like a security problem to me, but hearing your feedback will be helpful for the Spaces team as we think about how to support these features ---
**Author:** ![greendra](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/greendra/32/46012_2.png) [@greendra](https://discuss.huggingface.co/u/greendra)\ **Post date:** [October 25, 2022, 8:20pm UTC](https://discuss.huggingface.co/t/no-access-control-allow-origin-header-error-on-embed/24964/8 "2022-10-25T20:20:45Z")
Was working fine for months previously. I did not want the files to appear on Huggingface website as they contain files with keys in them. Keys are not stored as secrets because there is no easy way to add and remove 500 secret keys, and I swap them out regularly. Not your average use case, sure. But annoying that it was working before and now is not! I also like to be able to access my other private spaces from mobile via embed, but I can’t do that anymore. ---
**Author:** ![radames](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/radames/32/28246_2.png) [@radames](https://discuss.huggingface.co/u/radames)\ **Post date:** [October 25, 2022, 8:33pm UTC](https://discuss.huggingface.co/t/no-access-control-allow-origin-header-error-on-embed/24964/9 "2022-10-25T20:33:58Z")
hi @greendra , we’re working on a possibility to send a token with your request so we’ll be able to access your private Space and Embed, however if you embed it on a public page other’s will be able to access your private token. ---
**Author:** ![abidlabs](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/abidlabs/32/21878_2.png) [@abidlabs](https://discuss.huggingface.co/u/abidlabs)\ **Post date:** [October 25, 2022, 8:35pm UTC](https://discuss.huggingface.co/t/no-access-control-allow-origin-header-error-on-embed/24964/10 "2022-10-25T20:35:28Z")
> [@greendra](#): > > I also like to be able to access my other private spaces from mobile via embed, but I can’t do that anymore. Can you elaborate on this a little more? Why do use use embed to access your private Spaces on mobile instead of just opening HF Spaces on your phone? ---
**Author:** ![greendra](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/greendra/32/46012_2.png) [@greendra](https://discuss.huggingface.co/u/greendra)\ **Post date:** [October 25, 2022, 9:20pm UTC](https://discuss.huggingface.co/t/no-access-control-allow-origin-header-error-on-embed/24964/11 "2022-10-25T21:20:55Z")
It’s just nice to have all my models on one page in one place. I have added some encryption to my app so that the sensitive data no longer displays, which means it’s okay being public now. However the feature would be nice still as I’d rather my space not be so easily findable and copyable by others, whilst still allowing me to be able to embed it on my sites. Thanks for all the help. 🙂 ---
**Author:** ![greendra](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/greendra/32/46012_2.png) [@greendra](https://discuss.huggingface.co/u/greendra)\ **Post date:** [October 28, 2022, 7:43pm UTC](https://discuss.huggingface.co/t/no-access-control-allow-origin-header-error-on-embed/24964/12 "2022-10-28T19:43:33Z")
Thought I’d just add that another reason is because I run javascript in my gradio model to prevent spam use. This javascript does not run on the huggingface website however, but does run when embedded.