If you have ever built a modern JavaScript app inside a FileMaker Web Viewer that calls FileMaker Server APIs — like OData or the Data API — directly via fetch(), you have almost certainly run into the classic browser wall:

Preflight response is not successful. Status code: 405
Fetch API cannot load https://fms.example.com/fmi/odata/v4/... due to access control checks.

Behind that single error sits a two-headed problem:

1. Cross-Origin Resource Sharing (CORS): Your Web Viewer page and the FileMaker Server API live on different origins (or ports/protocols), and FMS’s default Apache configuration does not answer OPTIONS preflight requests or reflect your app’s origin.
2. TLS / SSL trust: FileMaker Server requires HTTPS for OData. On an internal network where port 80 is unavailable or already taken by another server, getting a valid certificate onto FMS — or trusting a self-signed certificate across every client device — quickly turns into a maintenance headache.

Three proven ways out #

In our new open-source guide, fms-cors-proxy, we break down the three practical architectures to solve this cleanly on FileMaker Server.

1. The same-origin reverse proxy (nginx in front of FMS) #

If you already run a primary web server on your network with ports 80/443 and a valid Let’s Encrypt certificate, put nginx in front of FileMaker Server:

• Serve your Web Viewer app directly from nginx.
• Reverse-proxy /fmi/ requests internally to FileMaker Server using proxy_ssl_verify off.

Because the browser only ever talks to nginx over a single domain with a valid certificate, CORS disappears completely, fetch() works out of the box on every client (FileMaker Pro, Go, and WebDirect), and FMS can keep its default self-signed certificate untouched.

👉 Open the interactive reverse-proxy map — trace every request from the browser through nginx to FileMaker Server, step by step.

2. Direct CORS configuration on FileMaker Server (httpd.conf) #

When your web application genuinely needs to live on a separate host, you have to embrace cross-origin requests. Our guide walks through the exact <Location "/fmi"> rules needed in FileMaker Server’s Apache configuration (httpd.conf and httpd.conf.2.4), including:

• Reflecting trusted LAN origins (with port numbers).
• Allowing the headers required by fms-odata-js (odata-version, Prefer, Authorization, etc.).
• Returning 200 OK on OPTIONS preflight requests instead of 405 Method Not Allowed.
• Reloading FMS’s Apache gracefully via launchctl kickstart without bouncing the database server.

👉 Open the interactive CORS/Apache map — click through the full preflight and response flow on FileMaker Server.

3. Automated Let’s Encrypt DNS-01 on FMS #

Want FileMaker Server itself to be the single endpoint with a valid certificate on both HTTPS (443) and FileMaker client connections (5003), without opening port 80 to the internet? We also link to our sister repository, fms-letsencrypt-dns01, which automates DNS-01 certificate issuance and renewal directly on FMS — we covered it in depth in our previous post.

Read the full guide & grab the config templates #

Whether you want to eliminate CORS with a 15-line nginx block or fix Apache preflights directly on FileMaker Server, the repository includes step-by-step instructions, verification curl commands, troubleshooting tables, and ready-to-use configuration templates.

👉 Check out fms-cors-proxy on GitHub