How I successfully enabled CORS with 'Access-Control-Allow-Origin' and request.cookies

[rushglen]

The original problem was the inability to change the Access-Control-Allow-Origin header, I could change all the other headers but this one refused to change from "*" which means any other site can connect, kind of defeats the purpose of cors if I can't lock it down to only my url!

Digging into the code I found that in /root/node_modules/peer/dist/src/api/index.js it is using cors_1.default (see https://expressjs.com/en/resources/middleware/cors.html) The default configuration is the equivalent of:

{ "origin": "*", "methods": "GET,HEAD,PUT,PATCH,POST,DELETE", "preflightContinue": false, "optionsSuccessStatus": 204 }

This is over riding any attempt by me to change the the 'Access-Control-Allow-Origin' header The solution was to comment out the one line in index.js => //app.use(cors_1.default());

Then my code: `const fs = require('fs'); const https = require('https'); const express = require('express'); const { ExpressPeerServer } = require('peer');

const app = express();

const options = { key: fs.readFileSync('../../etc/ssl/**.key'), //server.key'), cert: fs.readFileSync('../../etc/ssl/**.crt'),//,server.crt')
};

const server = https.createServer(options, app);

const peerServer = ExpressPeerServer(server, { debug: true, path: '/' });

app.use(function(req, res, next) { // CORS headers see /root/node_modules/peer/dist/src/api/index.js comment out: //app.use(cors_1.default()); // with GET browser doesn't always send preflight OPTIONS request - https://stackoverflow.com/questions/38742379/cors-why-my-browser-doesnt-send-options-preflight-request res.setHeader('Access-Control-Allow-Origin', 'https://myIncredibleSite.com'); res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS, GET'); res.setHeader('Access-Control-Allow-Credentials', true);

if ( req.method === 'OPTIONS' ) {
    console.log('req.method == options');
    res.writeHead(200);
    res.end();

}
next();

});

app.use('/', peerServer);

server.listen(9000); ` Now the 'Access-Control-Allow-Origin' was being set for my site! Response Headers:

Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, OPTIONS, GET Access-Control-Allow-Origin: https://myIncredibleSite.com Connection: keep-alive Content-Length: 36 Content-Type: text/html; charset=utf-8 Date: Sat, 27 Nov 2021 00:32:01 GMT ETag: W/"24-qROaMSL2j4dbBprousQgu07UvSw" Keep-Alive: timeout=5 X-Powered-By: Express``

However still not 100% as no cookies were being sent in the request headers using peerjs.js in the browser.... digging again..! I found that peerjs.js is using fetch as opposed to xhr.

I changed the 'fetch' line to: fetch(url,{credentials: 'include'})]; (there are 2 fetch one for getting the id and the other: listAllPeers)

credentials: include adds cookies to the request, I needed this to track/check the session cookie.

Now I am getting cookies sent in the request as well!

Hopefully this will help someone, CORS is a difficult beast! I recommend finally doing a test run on a different site to check that cors is actually working the way you expect.

Andrew