Am having cors issues but i don't know how to reso...

# ktor

[david dereba]

Am having cors issues but i don't know how to resolve it, kindly assist.

fun Application.configureHTTP() {

    install(CORS) {
        HttpMethod.DefaultMethods.forEach {  allowMethod(it) }
        allowHeaders { true }
        anyHost() // @TODO: Don't do this in production if possible. Try to limit it.
    }
}


fun main(args: Array<String>) {
    EngineMain.main(args)
}

fun Application.module() {
    configureSerialization()
    configureDatabases()
    configureHTTP()
    configureSecurity()
    configureRouting()
    DatabaseFactory.init(this)
    configureKoin()
    testRoutesImplementation()
    rolesRoutesImplementation()
    usersRoutesImplementation()
    userRolesRoutesImplementation()
    authenticationImplementation()
    locationsRoutesImplementation()
    productCategoriesRoutesImplementation()
    productsRoutesImplementation()
    farmersRoutesImplementation()
    aggregatorRoutesImplementation()
    aggregatorFarmersRoutesImplementation()
    aggregatorProductRoutesImplementation()
    storeRoutesImplementation()
    summariesRoutesImplementation()
}

[Aleksei Tirman [JB]]

Can you describe the problem?

[david dereba]

OK.
The frontend is being blocked by CORS policy. actually the error is, no Acceess-Control-Allow-Origin Header is present on the requested resource

[Aleksei Tirman [JB]]

Can you share the server logs for the blocked request?

[david dereba]

Access to XMLHttpRequest at 'http://109.123.254.230:8084/api/auth/v1/login' from origin 'http://localhost:5173' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

[Abdulrahman Al Sabagh (Abudi)]

YOu need allowCredentials = true I guess

[david dereba]

@Abdulrahman Al Sabagh (Abudi) Thanks man, Let me try it. I hope it works

[Aleksei Tirman [JB]]

If I make the following request, the server responds with 200 status code and the Access-Control-Allow-Origin header:

curl --request OPTIONS \
  --url <http://109.123.254.230:8084/api/auth/v1/login> \
  --header 'Access-Control-Request-Method: POST' \
  --header 'Origin: <http://localhost:5173>'

[Abdulrahman Al Sabagh (Abudi)]

allowHeader(HttpHeaders.AccessControlAllowOrigin)

You can also try this

[Aleksei Tirman [JB]]

Can you share the headers of the OPTIONS request which is made by the web browser?

[david dereba]

@Aleksei Tirman [JB], it is interesting because also when I access the request via postman it responds with 200 status.

these are the headers
Access to XMLHttpRequest at 'http://109.123.254.230:8084/api/auth/v1/login' from origin 'http://localhost:5173' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

request headers accept:
application/json, text/plain, /
accept-encoding:
gzip, deflate
accept-language:
en-GB,en
connection:
keep-alive
content-length:
51
content-type:
application/json
host:
109.123.254.230:8084
origin:
http://localhost:5173
referer:
http://localhost:5173/
sec-gpc:
1
user-agent:
Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Mobile Safari/537.36

response headers
2 requests
0 B transferred
0 B resources
HTTP/1.1 403 Forbidden
Content-Length: 0
Connection: keep-alive

[Renan Kummer]

The Ktor docs (https://ktor.io/docs/server-cors.html) on CORS are very good, I suggest reading them to make sure you're setting it up as you'd like.

allowNonSimpleContentTypes = true
allowCredentials = true
allowHeader(HttpHeaders.ContentType)
allowHeader(HttpHeaders.Authorization)

This is what I had to allow as a minimum to work with JSON payloads and Authorization header.

[Aleksei Tirman [JB]]

Most likely, the problem is that the web browser doesn't send the Access-Control-Request-Method header for some reason.

[Aleksei Tirman [JB]]

> these are the headers
The request you shared seems to be the original one. Can you share the preflight request?

[david dereba]

@Renan Kummer Let me check it out. Thank you

[david dereba]

Thank you so much guys, it has finally worked after doing this.

@Aleksei Tirman [JB], @Abdulrahman Al Sabagh (Abudi) and @Renan Kummer I really do appreciate.

fun Application.configureHTTP() {

    install(CORS) {
        HttpMethod.DefaultMethods.forEach {  allowMethod(it) }
        allowHeaders { true }
        allowHeader(HttpHeaders.AccessControlAllowOrigin)
        allowCredentials = true
        allowNonSimpleContentTypes = true
        allowHeader(HttpHeaders.ContentType)
        allowHeader(HttpHeaders.Authorization)
        anyHost() // @TODO: Don't do this in production if possible. Try to limit it.
    }
}

[Abdulrahman Al Sabagh (Abudi)]

I actually stumbled upon the same issue 1-2 weeks ago
The solution was something like this

allowMethod(HttpMethod.Put)
allowMethod(HttpMethod.Patch)
allowMethod(HttpMethod.Delete)
allowMethod(HttpMethod.Options)
allowMethod(HttpMethod.Get)
allowHeader(HttpHeaders.Authorization)
allowHeader(HttpHeaders.AccessControlAllowOrigin)
allowHeader(HttpHeaders.ContentType)
allowHeader(HttpHeaders.Authorization)
allowCredentials = true
allowSameOrigin = true
anyHost()

[Abdulrahman Al Sabagh (Abudi)]

so the exact one to yours..
I didn't send it immediately , because I thought there may be a better solution

[david dereba]

@Abdulrahman Al Sabagh (Abudi) Yeah , they are actually the same.

😀 I wish you would have sent the solution earlier, I didn't enjoy that bug at all. But thanks man