# HTTPRequest Origin="null"

**URL:** <https://talk.observablehq.com/t/httprequest-origin-null/121>\
**Category:** Help\
**Created:** [February 1, 2018, 8:06am UTC](https://talk.observablehq.com/t/httprequest-origin-null/121 "2018-02-01T08:06:56Z")\
**Posts on this page:** 1\
**Showing post:** 15

<div class="post-metadata">

**Author:** ![RandomFractals](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/randomfractals/32/759_2.png) [@RandomFractals](https://talk.observablehq.com/u/RandomFractals)\
**Post date:** [September 20, 2018, 11:07am UTC](https://talk.observablehq.com/t/httprequest-origin-null/121/15 "2018-09-20T11:07:01Z")

</div>

I think the main issue with the way observable sets up origin for code cell is that unlike the notebook itself, which has [https://beta.observablehq.com](https://beta.observablehq.com) origin, code cell frames are pinned to custom user static content.

See origin request header generated from a fetch() cell call:

 ![observable-fetch-headers](https://canada1.discourse-cdn.com/flex030/uploads/observablehq/original/2X/5/53656337922730013e6fd5f13ad5fc516d90d378.png)

Therefore, even if you have control over the server hosting a data API you’d like others to use on observable, you can’t simply add [beta.observable.hq.com](http://beta.observable.hq.com) to the ‘Access-Control-Allow-Origin’ whitelist response header for all devs on this site to use your API without CORS proxies, unless you \* for the public, which is not recommended

In fact, you can’t even use observable api itself, despite the fact that notebook document makes those requests for user info, collections, etc.

I put a short fetch.js notebook together to demonstrate this here (with links to specs and other fetch notebooks):

> **[Fetch](https://observablehq.com/@randomfractals/fetch)**
>
> An Observable notebook by Taras Novak.

---

_[View the full topic](https://talk.observablehq.com/t/httprequest-origin-null/121)._