Closed kevinsimper closed 1 year ago
I read #649 but my express server does not send a Content-Type
for the options request.
I enabled cors: { debug: true, enable: true }
and here is the logs:
May 15th 10:22:23am INFO production ee777f8 starting app: PORT=37105 command=node app.js
May 15th 10:22:23am INFO production ee777f8 started app: pid=16
May 15th 10:22:23am INFO production ee777f8 waiting for app to listen on PORT
May 15th 10:22:24am INFO production ee777f8 Listening on 37105
May 15th 10:22:25am INFO production ee777f8 app listening: duration=2.119s
May 15th 10:22:25am INFO production ee777f8 initialized: duration=2.139s
May 15th 10:22:25am INFO production ee777f8 request: id=17c01163-5819-11e8-8b68-81a75de3b259 ip=83.93.187.177 method=OPTIONS path=/graphql
May 15th 10:22:25am INFO production ee777f8 response: duration=39ms id=17c01163-5819-11e8-8b68-81a75de3b259 ip=83.93.187.177 method=OPTIONS path=/graphql size=0 B status=200
May 15th 10:22:25am INFO 2018-05-15T08:22:25.679Z 17c0ad4a-5819-11e8-a6ac-55a9af9527f7 [shim] unexpected non-json line: `[cors] 2018/05/15 08:22:25 Handler: Preflight request`
May 15th 10:22:25am INFO 2018-05-15T08:22:25.680Z 17c0ad4a-5819-11e8-a6ac-55a9af9527f7 [shim] unexpected non-json line: `[cors] 2018/05/15 08:22:25 Preflight aborted: empty origin`
May 15th 10:22:25am INFO REPORT RequestId: 17c0ad4a-5819-11e8-a6ac-55a9af9527f7 Duration: 2330.19 ms Billed Duration: 2400 ms Memory Size: 512 MB Max Memory Used: 61 MB
May 15th 10:24:36am INFO production ee777f8 request: id=67419cea-5819-11e8-8e96-9f5dbc1b57e7 ip=83.93.187.177 method=OPTIONS path=/login
May 15th 10:24:36am INFO production ee777f8 response: duration=0s id=67419cea-5819-11e8-8e96-9f5dbc1b57e7 ip=83.93.187.177 method=OPTIONS path=/login size=0 B status=200
May 15th 10:24:36am INFO 2018-05-15T08:24:36.500Z 6743e75c-5819-11e8-8bfb-1d4902f23e99 [shim] unexpected non-json line: `[cors] 2018/05/15 08:24:36 Handler: Preflight request`
May 15th 10:24:36am INFO 2018-05-15T08:24:36.500Z 6743e75c-5819-11e8-8bfb-1d4902f23e99 [shim] unexpected non-json line: `[cors] 2018/05/15 08:24:36 Preflight response headers: map[Vary:[Accept-Encoding Origin Access-Control-Request-Method Access-Control-Request-Headers] Access-Control-Allow-Origin:[*] Access-Control-Allow-Methods:[POST] Access-Control-Allow-Headers:[Content-Type]]`
May 15th 10:24:36am INFO REPORT RequestId: 6743e75c-5819-11e8-8bfb-1d4902f23e99 Duration: 18.26 ms Billed Duration: 100 ms Memory Size: 512 MB Max Memory Used: 61 MB
May 15th 10:24:36am INFO production ee777f8 request: id=675bdb66-5819-11e8-bdf4-6984ec10250f ip=83.93.187.177 method=POST path=/login size=291 B
May 15th 10:24:36am INFO 2018-05-15T08:24:36.640Z 675c9edb-5819-11e8-b5f9-bd980eec6d1d [shim] unexpected non-json line: `[cors] 2018/05/15 08:24:36 Handler: Actual request`
May 15th 10:24:36am INFO 2018-05-15T08:24:36.640Z 675c9edb-5819-11e8-b5f9-bd980eec6d1d [shim] unexpected non-json line: `[cors] 2018/05/15 08:24:36 Actual response added headers: map[Vary:[Accept-Encoding Origin] Access-Control-Allow-Origin:[*]]`
May 15th 10:24:37am INFO production ee777f8 response: duration=852ms id=675bdb66-5819-11e8-bdf4-6984ec10250f ip=83.93.187.177 method=POST path=/login size=489 B status=200
May 15th 10:24:37am INFO REPORT RequestId: 675c9edb-5819-11e8-b5f9-bd980eec6d1d Duration: 853.84 ms Billed Duration: 900 ms Memory Size: 512 MB Max Memory Used: 63 MB
May 15th 10:24:38am INFO production ee777f8 request: id=685f8fe6-5819-11e8-bda9-03101e565b5e ip=83.93.187.177 method=OPTIONS path=/graphql
May 15th 10:24:38am INFO production ee777f8 response: duration=0s id=685f8fe6-5819-11e8-bda9-03101e565b5e ip=83.93.187.177 method=OPTIONS path=/graphql size=0 B status=200
May 15th 10:24:38am INFO 2018-05-15T08:24:38.339Z 685fddfd-5819-11e8-885b-e9c995cc9bde [shim] unexpected non-json line: `[cors] 2018/05/15 08:24:38 Handler: Preflight request`
May 15th 10:24:38am INFO 2018-05-15T08:24:38.339Z 685fddfd-5819-11e8-885b-e9c995cc9bde [shim] unexpected non-json line: `[cors] 2018/05/15 08:24:38 Preflight aborted: headers '[Authorization Content-Type]' not allowed`
May 15th 10:24:38am INFO REPORT RequestId: 685fddfd-5819-11e8-885b-e9c995cc9bde Duration: 1.45 ms Billed Duration: 100 ms Memory Size: 512 MB Max Memory Used: 63 MB
May 15th 10:24:45am INFO production ee777f8 request: id=6cacf0ed-5819-11e8-b2e0-c9e5dc9b6bbd ip=83.93.187.177 method=OPTIONS path=/graphql
May 15th 10:24:45am INFO production ee777f8 response: duration=0s id=6cacf0ed-5819-11e8-b2e0-c9e5dc9b6bbd ip=83.93.187.177 method=OPTIONS path=/graphql size=0 B status=200
May 15th 10:24:45am INFO 2018-05-15T08:24:45.555Z 6cad3f86-5819-11e8-9229-67363aa6ed38 [shim] unexpected non-json line: `[cors] 2018/05/15 08:24:45 Handler: Preflight request`
May 15th 10:24:45am INFO 2018-05-15T08:24:45.556Z 6cad3f86-5819-11e8-9229-67363aa6ed38 [shim] unexpected non-json line: `[cors] 2018/05/15 08:24:45 Preflight aborted: headers '[Authorization Content-Type]' not allowed`
May 15th 10:24:45am INFO REPORT RequestId: 6cad3f86-5819-11e8-9229-67363aa6ed38 Duration: 1.69 ms Billed Duration: 100 ms Memory Size: 512 MB Max Memory Used: 63 MB
Also the examples in the git repo does not cover CORS with POST and authorization header and the graphql example
Found something that wasn't in the documentation, but was available in the code,
It is not used in any of the examples https://github.com/apex/up-examples/search?utf8=%E2%9C%93&q=allowed_headers&type=
But I will add one 😄
I would also suggest that allowed_headers
starts with a default with Content-Type
as the browser adds it by default, as seen in the curl
example above.
I'll fix the docs, I just noticed the defaults for allowed_headers is incorrect on the site, it's "Origin", "Accept", "Content-Type", "X-Requested-With"
by default — and I'll add CORS to the graphql example
Fixed the docs to show those defaults and added https://github.com/apex/up-examples/commit/b3339a64ee6d8e0fe805290593865a8a5c80c782
That is awesome, thank you! 👍
Prerequisites
up upgrade
)-v, --verbose
flag.Description
When the
access-control-request-headers
header is set theCORS
headers are not returned and therefore CORS breaks in javascript. The first example is my localhost, the second is without the headers that they browsers send, and the third is to simulate the browsers header.