search

dgraph-io / dgraph-docs

A native GraphQL Database with a graph backend
https://dgraph.io/docs
Other
35 stars 66 forks source link

[BUG] Dgraph.Allow-Origin CORS setting does not work as docs claim #640

Open ericwhitefield opened 1 year ago

ericwhitefield commented 1 year ago

Documentation here: https://dgraph.io/docs/graphql/security/cors/

Claims that adding config line(s) to the bottom of the Schema file will modify the Response header accordingly.

Perhaps "star" would be a special case. Or perhaps not. The Docs do not specify if a "star" would cause the Response header to contain "star", OR if the header would echo back the Referrer header of the Request. Either way, it's not currently working.

For specifically listed domains one might assume the Response header would echo back the Request's "Referrer" header.

# Dgraph.Allow-Origin "*"

Expected response header:

access-control-allow-origin: *

Actual response header: ❌ 

access-control-allow-origin: https://cloud.dgraph.io
# Dgraph.Allow-Origin "https://localhost:3000"
# Dgraph.Allow-Origin "https://example.com"

Expected response header from a request from https://localhost:3000

access-control-allow-origin: https://localhost:3000

Actual response header: ❌ 

access-control-allow-origin: https://cloud.dgraph.io
# Dgraph.Allow-Origin "https://localhost:3000"
# Dgraph.Allow-Origin "https://example.com"

Expected response header from a request from https://example.com

access-control-allow-origin: https://example.com

Actual response header: ❌ 

access-control-allow-origin: https://cloud.dgraph.io
# Dgraph.Allow-Origin "https://localhost:3000"
# Dgraph.Allow-Origin "https://example.com"

Expected response header from a request from https://cloud.dgraph.io

access-control-allow-origin: https://cloud.dgraph.io

Actual response header: ✅ 

access-control-allow-origin: https://cloud.dgraph.io
github-actions[bot] commented 4 months ago

This issue has been stale for 60 days and will be closed automatically in 7 days. Comment to keep it open.

Rajakavitha1 commented 2 months ago

Hi @ericwhitefield Thank you for reporting the issue. I am yet to validate all the expected reponses that you mentioned. However, the last response that you mentioned works as expected because the docs does specify that:

https://cloud.dgraph.io is always allowed so that API explorer, in Dgraph Cloud console, continues to work.