CORS & Proxy Gov

Configure CORS and proxy access to external government APIs.

Updated Mar 4, 2026
One-click install
npx skills add https://github.com/joabeoliveira/skills --skill cors-proxy-gov
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: CORS & Proxy Gov
Source: https://github.com/joabeoliveira/skills/tree/main/.skills/cors-proxy-gov
Command: npx skills add https://github.com/joabeoliveira/skills --skill cors-proxy-gov

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Government networks and enterprise firewalls often block direct browser requests to external APIs, making MVPs or front-end apps unable to fetch data from services like Dados Abertos, PNCP, ViaCEP, and BrasilAPI. This skill provides a layered strategy to overcome CORS and network restrictions in public sector environments, including testing without a proxy, using public proxies for prototyping, and deploying lightweight self-hosted proxies or Nginx configurations for production use.

Core Features & Use Cases

  • Direct access first: Validate whether the target API allows CORS from the browser without any intermediary.
  • Public proxy for prototyping: Quick, disposable proxy options to unblock development when production proxies are not yet in place (not recommended for production data).
  • Self-hosted proxy options: Lightweight Node.js proxy (Coolify/Easypanel) to add a controlled CORS layer, plus guidance for an Nginx reverse proxy for more robust deployments.
  • Operational guidance: Clear layering, origin whitelisting, timeouts, and security considerations for deployments in gov networks.

Quick Start

Start by testing direct browser access to the external API and, if blocked, deploy a lightweight proxy on your hosting platform and update your frontend to route API calls through it.

Frequently Asked Questions about CORS & Proxy Gov

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix CORS errors when fetching data from government APIs in a frontend app?

CORS errors fetching government APIs are fixed using a layered strategy: test direct browser access first, then use public proxies for prototyping, and finally deploy a self-hosted proxy for production access.

What is the best way to access external APIs like Dados Abertos from a corporate network?

Accessing external APIs like Dados Abertos from corporate networks is best achieved by deploying a lightweight self-hosted Node.js or Nginx reverse proxy to bypass firewall restrictions and add controlled CORS headers.

Can I use a public CORS proxy for production data in government environments?

Public CORS proxies are not recommended for production data in government environments; they are restricted to quick prototyping, while production requires deploying a self-hosted proxy for controlled security.

How do I set up an Nginx reverse proxy to resolve browser CORS restrictions?

Setting up an Nginx reverse proxy to resolve CORS involves configuring it to route browser requests to target government APIs, adding controlled CORS headers, defining origin whitelists, and setting timeouts for robust deployments.

Why do direct browser requests to BrasilAPI fail when deployed on GitHub Pages?

Direct browser requests to BrasilAPI from GitHub Pages fail due to CORS and network restrictions blocking external API access; resolving this requires routing frontend API calls through a lightweight proxy.

Do I need a backend proxy to fetch data from ViaCEP in an MVP?

You do not strictly need a backend proxy for an MVP if ViaCEP allows direct browser CORS access; if blocked, use a public proxy for prototyping before deploying a self-hosted proxy.