Public RPC endpoint (rpc.testnet.arc.network) missing CORS headers — browser DApps cannot call it directly

[osr21]

Summary

https://rpc.testnet.arc.network does not return Access-Control-Allow-Origin headers. Any browser-based DApp that attempts to call the RPC endpoint directly receives a CORS error and the request fails silently.

Reproduction

// In a browser console or any frontend JS context:
const res = await fetch("https://rpc.testnet.arc.network", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ jsonrpc: "2.0", method: "eth_chainId", params: [], id: 1 }),
});
// Result: CORS error — no Access-Control-Allow-Origin header present

Impact

• Every browser-based DApp on Arc Testnet must proxy RPC requests through a backend server to work around this
• This adds infrastructure complexity for every developer building on Arc Testnet
• Developers coming from other EVM chains (Ethereum, Base, Arbitrum) expect the public RPC to be directly callable from the browser — their public endpoints all include CORS headers
• The workaround (backend proxy) means DApps need a server just to relay JSON-RPC calls, which defeats the purpose of a public RPC endpoint for frontend development

Suggested Fix

Add the following response headers to all requests to rpc.testnet.arc.network:

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: POST, OPTIONS
Access-Control-Allow-Headers: Content-Type

Handling OPTIONS preflight requests correctly is also required.

Context

Discovered while building Arc Pay — a gasless stablecoin transfer DApp on Arc Testnet. We built a dedicated Arc RPC Gateway as a workaround, but this should not be necessary for basic browser connectivity.

[osr21]

Workaround confirmed + additional option

In addition to using a backend proxy, there is now a cleaner in-browser workaround:

Option 1: Use dRPC's Arc Testnet endpoint (has CORS headers)

import { ethers } from "ethers";

// Works directly in browser — dRPC returns Access-Control-Allow-Origin: *
const provider = new ethers.JsonRpcProvider("https://arc-testnet.drpc.org");

// For write operations (using MetaMask for signing, dRPC for reads):
const signer = await new ethers.BrowserProvider(window.ethereum).getSigner();

Option 2: Use MetaMask's injected provider

// window.ethereum proxies JSON-RPC through MetaMask — no CORS restriction
const provider = new ethers.BrowserProvider(window.ethereum);
// All provider.getBlock(), provider.getLogs() etc. work without CORS issues

Option 3: Backend proxy — forward POST /rpc to rpc.testnet.arc.network and add the CORS headers server-side.

The quickest fix for the Arc team would be to add CORS headers to the public RPC endpoint itself — one nginx config change would unblock all browser DApp developers.