Route requests through local proxy with CORS

u8sand commented 3 years ago

Because VSCode has no intention of changing their stance on required CORS headers to work in webviews https://github.com/microsoft/vscode/issues/72900 -- the only workaround I see is using a proxy service like http://www.whateverorigin.org/ which just proxies requests and adds CORS headers.

Fortunately this app is in a unique place in that it's already running a webserver. So we can use that same server to proxy requests and add CORS. This is pretty easy with SwaggerUIBundle's requestInterceptor config argument which takes a function for altering requests.

Thus this PR does two things:

add a /proxy endpoint to the server which takes a query param url with the actual URL. use request library to forward the entire request object to that url. Add CORS to the response and return it.
add requestInterceptor argument to SwaggerUIBundle to change the url to use the backend's /proxy?url=...

The result -- no need to worry about CORS, the UI works the same.

Fixes #30 Fixes #23

Edit: Since this has been here for a while; if anyone is interested in using this now it can be done with the release on my fork where I have included the compiled vsix file: https://github.com/MaayanLab/vs-swagger-viewer/releases if you do use it, let me know if you find any issues.

Edit: Updated a bit to fix an issue with POST requests

eliminate request as a dependency, using instead http and https
Instead of the query parameter url which may also cause conflicts, we always POST to /proxy serializing the url, method, headers, and body with json

Edit: A bug in the last fix broke querystrings :facepalm: this was fixed.

pass url directly to request instead of trying to rebuild it in the options

kitarikes commented 2 years ago

Thanks to you, I was able to resolve the error！

kitarikes commented 2 years ago

I did notice one problem.

In the swagger preview, the request is made as a POST, but when I checked the API server log, I noticed that the request was rewritten as a GET (probably by a script that avoids cors).

So anything other than GET requests won't work properly.

u8sand commented 2 years ago

This should be an easy fix, i can do it later today. Thanks for reporting.

Edit: I've updated it, the PR comment, merged with upstream and re-released.

arjun-g / vs-swagger-viewer

Route requests through local proxy with CORS #95