Still missing access control headers in API responses

[RobertDev]

Dear Fitbit developers,

I’ve noticed that I’m still encountering many preflight (CORS policy) errors because not all endpoints return the required access control headers in their responses. Some endpoints do this correctly and don't cause any issues.

I see this topic mentioned in various threads on this forum, such as:

https://community.fitbit.com/t5/Web-API-Development/401-Unauthorized-error-for-OPTIONS-preflight-req...
https://community.fitbit.com/t5/Web-API-Development/Missing-CORS-response-header-for-activity-APIs/t...

However, when users ask for updates, there is no response. This is very frustrating, as this issue is breaking many of your users’ apps.

In our case, the following endpoints are affected:

https://api.fitbit.com/1/user/-/activities/calories/date/startdate/enddate.json
https://api.fitbit.com/1/user/-/body/weight/date/startdate/enddate.json
https://api.fitbit.com/1/user/-/body/fat/date/startdate/enddate.json

The other endpoints are working fine at this moment.

Hopefully, someone can respond. As this problem keeps recurring, it is becoming impossible to develop stable apps. 😞

[EDIT] Anyone? @GordonFitbit @JohnFitbit Any other Fitbit dev? Do you need more information? I also tried to email but it looks impossible to get in contact about this subject. 😞 Please help, my app is broken....

Kind regards,
Robert

[GordonFitbit]

Hi @RobertDev 

Thank you for your patience.   I'm currently research this problem and will reply once I get an answer.

[RobertDev]

Thank you so very much @GordonFitbit !

Some information that might help. Below we see a request that succeeds and other requests that fail. The first one has all the required headers:

Now look at a request that fails:

Because there are missing headers, this results in:

Hope this helps. Other information that maybe helps: The same problem existed on other endpoints early this year. That has been fixed then. The current issue is exactly the same as then but now for the other endpoints I mentioned.

Do I need to provide you with my clients ID's?

Thanks in advance for your support!