# Builder Blocked by external services - how to whitelist?

**URL:** <https://forum.builder.io/t/builder-blocked-by-external-services-how-to-whitelist/15842>\
**Category:** Technical Questions\
**Created:** [October 7, 2025, 12:39pm UTC](https://forum.builder.io/t/builder-blocked-by-external-services-how-to-whitelist/15842 "2025-10-07T12:39:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![SJCGALLET](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.builder.io/sjcgallet/32/5357_2.png) [@SJCGALLET](https://forum.builder.io/u/SJCGALLET)\
**Post date:** [October 7, 2025, 12:39pm UTC](https://forum.builder.io/t/builder-blocked-by-external-services-how-to-whitelist/15842/1 "2025-10-07T12:39:27Z")

</div>

_I developed a feature which is not working on the builder environment but works fine once deployed or running locally on my machine._

**Builder content link**  
Fusion

**Builder public api key**  
17cf155901d9412d91f3909c0aedbfdb

**What are you trying to accomplish**  
_I have as feature which downloads Whispr model files to do on-device voice recognition. I’m hosting the files on firebase storage (was initially downloading directly from huggingface but was encountering issues, so I resorted to having them on a controlled environment to check if access was the issue). The file download works fine when the code is deployed, but somehow not in builder_… My firebase storage rules are open for reads on the folder, and CORS policy set on the bucket to allow get on https://\*.fly.dev which I thought would work…

**Screenshots or video link**

 ![image](https://us1.discourse-cdn.com/flex020/uploads/builder/original/2X/9/9b71bf7d6a210a6c28d6b61f3741a4c0d9e1dd5a.png)on builder –\> progress stuck at 15% (no files downloading)

 ![image](https://us1.discourse-cdn.com/flex020/uploads/builder/original/2X/1/13a574590ea0f4f774708674bf2adffe3240f8d4.png)deployed –\> file download complete

**Code stack you are integrating Builder with**  
\*Firebase DB, Firebase Storage, GCP

Any ideaS?\*

---

<div class="post-metadata">

**Author:** ![SJCGALLET](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.builder.io/sjcgallet/32/5357_2.png) [@SJCGALLET](https://forum.builder.io/u/SJCGALLET)\
**Post date:** [October 7, 2025, 12:43pm UTC](https://forum.builder.io/t/builder-blocked-by-external-services-how-to-whitelist/15842/2 "2025-10-07T12:43:57Z")

</div>

Correction: It works fine when DEPLOYED on Firebase Hosting…does NOT work on my local environment (localhost:8080). How could that be?

---

<div class="post-metadata">

**Author:** ![manish-sharma](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@manish-sharma](https://forum.builder.io/u/manish-sharma)\
**Post date:** [October 9, 2025, 10:57am UTC](https://forum.builder.io/t/builder-blocked-by-external-services-how-to-whitelist/15842/3 "2025-10-09T10:57:44Z")

</div>

Hello @SJCGALLET,

It looks like the issue you’re running into is likely related to **CORS and the environment your code is running in**.

Here’s what’s happening:

**Why it works when deployed but not in Builder/local:**

- Your Firebase Storage CORS is probably set to allow only your deployed domain (e.g., `https://*.fly.dev`).
- [Builder.io](http://Builder.io) previews and local development (`http://localhost:8080`) are **different origins** , so the browser blocks the download due to CORS restrictions.
- That’s why downloads complete fine when deployed, but get stuck at 15% in Builder or on localhost.

**Possible solutions:**

1. **Update Firebase Storage CORS** to include local dev and Builder preview origins. For example:

```auto
[
  {
    "origin": ["http://localhost:8080", "https://builder.io", "https://*.fly.dev"],
    "method": ["GET"],
    "maxAgeSeconds": 3600
  }
]

```

Then apply it with:

```auto
gsutil cors set cors.json gs://YOUR_BUCKET_NAME

```

1. **Use signed URLs** for your files. This bypasses CORS restrictions and works in any environment since the URL itself grants access.
2. **Proxy through your server** : Create an endpoint on your server that fetches the files from Firebase and serves them to the client. Since the client is calling your server (same origin), CORS issues are avoided entirely.

Hope this helps!

Thanks,