What s your CORS config

Question

vincent.brule · Answer

I m really not a pro with the CORS issue I try this in ktor install DefaultHeaders header HttpHeaders AccessControlAllowOrigin header HttpHeaders AccessControlExposeHeaders ANNIA SESSION install CORS anyHost method HttpMethod Get method <http HttpMethod Post|HttpMethod Post> method HttpMethod Put header ANNIA SESSION

vincent.brule · Answer

For the get request that works but no with my put request

mp · Answer

Ah You need to use the actual hostname ` ` `anyHost ` wn t work I ll pull up the spec to explain why hang on

vincent.brule · Answer

I need to replace anyHost by host

mp · Answer

gt When responding to a credentialed request the server must specify an origin in the value of the Access Control Allow Origin header instead of specifying the wildcard

mp · Answer

No it should be something like `<http localhost 3000>`

mp · Answer

Supply the allowed origin as part of your config

mp · Answer

BTW since you re configuring security for browsers you might be interested in <https bitbucket org marshallpierce ktor csrf src master > disclaimer I m the author

vincent.brule · Answer

Is there a method to totally disable CORS because I have many issue with this

mp · Answer

You d have ot disable it from the browser side if you wanted it gone However you probably want to figure out the issues sooner rather than later because you don t want to debug this in production

vincent.brule · Answer

Yes I understand

vincent.brule · Answer

I have the impression CORS just are a problem for back end developer

mp · Answer

I d say they make life easier by allowing us to write the backend separately from the frontend slightly smiling face

mp · Answer

Here s my cors config that works great for me ``` install CORS val originUrl = config corsAllowOrigin val host = if originUrl port gt 0 $ originUrl host $ originUrl port else originUrl host host host schemes = listOf originUrl protocol allowCredentials = true header X MI AntiCSRF method HttpMethod Delete ```

mp · Answer

`config corsAllowOrigin ` is a `URL` which is broken apart as the CORS config API prefers

vincent.brule · Answer

Thanks

vincent.brule · Answer

I don t understand the goal of CORS Is it to secure the back

mp · Answer

The goal is to selectively configure the browser to lift the same origin policy that would normally restrict XHR requests

mp · Answer

If js running on `` tried ot access `` browsers won t let it do that because of security

vincent.brule · Answer

But if I try without localhost but with an external server I will not have these problems

mp · Answer

However if `<http bar com|bar com>` is intended to be consumed by websites it can use CORS to tell the browser nah it s fine

vincent.brule · Answer

Just for your code What is corsAllowOrigin

mp · Answer

An external server will behave the same except that the difference in origin will presumably because the domain is different rather than the port on local dev typically everything is `localhost` but with different ports for the http server that serves your JS your backend API databse etc

mp · Answer

That method is on my config class it returns a URL e g `URL <http localhost 3000> `

vincent.brule · Answer

So the problem is the same origin localhost

vincent.brule · Answer

I have the same error with your code disappointed

mp · Answer

can you paste the preflight request from your browser s dev tools

vincent.brule · Answer

Request URL <http localhost 8080 employee update informations> Request Method OPTIONS

vincent.brule · Answer

this one

mp · Answer

right but with all the headers

mp · Answer

and paste the current CORS config you re using

vincent.brule · Answer

Access Control Expose Headers ANNIA SESSION Connection keep alive Content Length 0 Date Fri 06 Jul 2018 13 23 06 GMT Server ktor server core 0 9 2 ktor server core 0 9 2

vincent.brule · Answer

val originUrl = URL val host = if originUrl port gt 0 $ originUrl host $ originUrl port else originUrl host host host schemes = listOf originUrl protocol method HttpMethod Delete method HttpMethod Get method method HttpMethod Put header ANNIA SESSION

vincent.brule · Answer

I have a react app on localhost 3000

mp · Answer

Remove `anyHost`

vincent.brule · Answer

Yes sorry It was not the good CORS config I edit it

mp · Answer

also get post are already allowed methods by default

mp · Answer

what are the request headers for the preflight

vincent.brule · Answer

I remove it thanks

vincent.brule · Answer

Accept Accept Encoding gzip deflate br Accept Language en US en q=0 9 Access Control Request Headers content type headerannia Access Control Request Method PUT

mp · Answer

also probably not an issue here but I see that you re on ktor 0 9 2 0 9 3 is current

vincent.brule · Answer

Thanks I update it

mp · Answer

Ah So the browser is asking if it s ok to send `headerannia` but the server cors config is only whitelisting `annia session` try changing your cors config to use `headerannia`

vincent.brule · Answer

Oh I have a variable on my react app name headerannia but the clojure was not respected so my app put the variable name for the header that s the problem Thank you very much

vincent.brule · Answer

Sorry for your time it was my mistake disappointed

mp · Answer

NP and now you know how to debug CORS slightly smiling face

vincent.brule · Answer

Yes sure I already had many problems with CORS and I just manage some trick but now I know how to do thank you

Deactivated User · Answer

Thanks for helping < mp> slightly smiling face I had a similar issue here I m going to update the documentation to give some hints on this issue +1

vincent.brule · Answer

The problem is not the documentation but my lack of knowledge with CORS wink

mp · Answer

re that config note that get post are already enabled and browsers won t honor `anyHost ` with credentialed requests

mp · Answer

I think struggling with CORS a bit is just one of those things that has to happen every time you start a new project

mp · Answer

Oh right CORS cursing

Deactivated User · Answer

slightly smiling face well still if we can provide some hints on which things can go wrong or provide useful resources for troubleshooting it is always a start I guess

mp · Answer

Yeah I think having a real world working setup is a great start

mp · Answer

in practice people are probably going to want `PUT` and `DELETE` credentials and a custom header or two

Deactivated User · Answer

< mp> do you think this is a good snippet for a start or do you miss something

mp · Answer

Unfortunately `anyHost ` will be rejected by the browser for credentialed requests see Credentialed requests and wildcards in Must use `host ` form instead

mp · Answer

Most of the time services know which host s they re expecting to be serviced by so this isn t a problem to configure but hypothetically it might be an interesting extension point to allow people to plug in their own implementations of host checking

mp · Answer

i e one that always says whatever Origin is requested is allowed this would let you allow credentialed requests from everything An odd use case to be sure but that s one that currently can t be expressed

Deactivated User · Answer

I see thanks for the insights Maybe an issue to implement custom logic for origin accepting would be nice yes

mp · Answer

yep if the current CORS configuration could be wrapped up in a pluggable implementation that seems ideal if there s a clean way to do that That way most users could use the CORS engine that s shipped out of the box but if you needed to get crazy you could plug in your own logic

mp · Answer

without having to rewrite the pipeline integration that would be the same for everyone

mp · Answer

all problems can be solved with an additional layer of indirection wink Thanks JVM for making monomorphic virtual calls cheap