search

FlowFuse / device-agent

An agent to run FlowFuse managed instances of Node-RED on devices
Apache License 2.0
15 stars 8 forks source link

Device agent does not respond with correct CORS headers #241

Closed hardillb closed 4 months ago

hardillb commented 4 months ago

Current Behavior

Bu default Node-RED will respond with the following CORS headers when an OPTIONS HTTP request is made to a HTTP-in/HTTP-response pair

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Vary: Access-Control-Request-Headers

If the editor route is changed (e.g. to device-editor) it no longer returns CORS headers unless the httpNodeCors settings directive is enabled as the default CORS behaviour is handled by the editor.

Expected Behavior

The device agent should set the httpNodeCors to match the defaults

Steps To Reproduce

  1. Host an HTTP endpoint in a device agent
  2. Make a HTTP request from a 3rd party webpage or make a http OPTIONS call to the endpoint

Environment