Cannot serve requests to other microservices

[Vitineth]

Describe the bug When other microservices make requests to the gateway endpoints they fail the CORS preflight checks due to the wrong headers being applied to the response.

To Reproduce docker-compose up the uems-hub project and load the /events endpoint of the frontend. It will show Loading... permenantly and the console will display cors preflight errors.

Expected behavior Events should be loaded successfully from the gateway

Desktop (please complete the following information):

• OS: Windows 10
• Browser: Chrome
• Version: 83.0.4103.116

Notes Adding the following to app.ts fixes the problem temporarily but allows it to be requested from all domains (not sure if that is what we want)

app.use(function(req:any, res:any, next:any) {
  res.header("Access-Control-Allow-Origin", "*"); // update to match the domain you will make the request from
  res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Authorization");
  next();
});

[Lan2u]

Which app.ts?

Will read further into this to consider the security implications of allowing all domains.

[Vitineth]

Which app.ts?

Will read further into this to consider the security implications of allowing all domains.

src/app.ts of this repo. As long as it's placed above the routes it should work because I got it working in very quick testing

[Lan2u]

What about using this https://www.npmjs.com/package/cors ?

[Lan2u]

It seems we should restrict the allowed origin to the front end origin (e.g. localhost:15300) and the allowed methods to POST, GET, PATCH, DELETE, OPTIONS - will look into doing this with the cors package.

[Vitineth]

It seems we should restrict the allowed origin to the front end origin (e.g. localhost:15300) and the allowed methods to POST, GET, PATCH, DELETE, OPTIONS - will look into doing this with the cors package.

Would be good, we should probably base the origin off a configuration so there are minimal code changes when deploying into production. Cors package looks like a good option to make things clear and easy

[Lan2u]

It seems we should restrict the allowed origin to the front end origin (e.g. localhost:15300) and the allowed methods to POST, GET, PATCH, DELETE, OPTIONS - will look into doing this with the cors package.

Would be good, we should probably base the origin off a configuration so there are minimal code changes when deploying into production. Cors package looks like a good option to make things clear and easy

Potential solution in new gateway PR