Fix POST requests over HTTPS fail with 403 "Invalid CORS request"

hyunh90 commented 4 years ago

Site functionality is completely broken with below error:

Environment

Firefox 77.0.1
Enhanced tracking protection is OFF for the site
uBlock Origin is OFF for the site
Privacy Badger is OFF for the site

Steps to reproduce

Access Best buyer (note: this breakage happens all three functions)
Find any commodity and enter any amount
Click on Submit

Expected output

The tool lists potential best buyers.

Actual output

The tool fails to load with aforementioned error.

EtienneLamoureux commented 4 years ago

Thank you for the detailed report.

Can you reproduce the issue when using the Mirror?

This error message is consistent with an impossibility to reach the server, which I expect to happen in the early days of DNS propagation. It's only been ~18h since the last name servers change, so one call might reach and the next fail. Additionally, I'm currently in the process of setting up end-to-end SSL encryption, but for the moment it is only active between the client and the content-delivery-network solution, which is why some HTTPS calls still fail: some calls resolve with the old nameservers, and as end-to-end SSL is not yet configured, those calls fail.

This is a problem though, and I'll rectify it.

hyunh90 commented 4 years ago

Yup, on the mirror it works just fine.

EtienneLamoureux commented 4 years ago

I ran some tests. Results:	Network	Protocol
Origin server directly	HTTP	200 OK
Through cloudflare	HTTP	200 OK
Through cloudflare	HTTPS	403 "Invalid CORS request"

EtienneLamoureux commented 4 years ago

The joys of CORS. Should be all good now.

EtienneLamoureux / sc-trade-tools