https://kotlinlang.org logo
Join Slack
Powered by
I have a vue-js app that is bundled together with ...
# ktor
f
I have a vue-js app that is bundled together with webpack yes, I keep that in a separate folder and serve that folder as a static asset. What happens when CORS is not enabled at all? When it is not I can use relative paths but I cannot let another host call the server from javascript (which makes sense, that is how it should be) but when I enable CORS to give access to my javascript host, why is the self hosted javascript site then denied access? Do you have something I can look at concerning the webpack issue?
o
If served as static content, it shouldn’t be affected. I think webpack tweaks headers if it acts as a proxy, but I’m not sure.
@cy can you help?
f
I can put together a GitHub issue with a minimal example to produce the issue, would that be of help?
Just for clearance, Im not running the webpack server when deployed, I get this issue when I have deployed a jar to aws as well
c
Doesn't AWS have it's own CORS? Shouldn't it be configred separately ?
Or it is reproducible on localhost as well?
f
I may very way have this the wrong way, but don’t I need to enable CORS on the server to allow an external javascript client to do requests? I have not fully grasped what is going on, but it works if I allow the host on the server side via CORS. Or do I need to fiddle with CORS on S3? To me currently that is only if I want another js client to access what is on the S3 bucket riiiiight? 😄
It is reproducible on localhost as well yes
c
If you don't use webpack server then how do you get multiple ports? some kind proxy?
f
I run my ktor server on port 5000, just when developing do I run a webpack development server on port 8080, that is not really a problem, I want it to work when deployed
The issue is that the node vue app that I have served as a static asset can do requests against the server when CORS is not enabled through ktor but not when it is, unless I explicitly allow the server itself to to request against itself, namely 
localhost:5000
c
do static and ktor server run separately on AWS?
f
yes
c
AWS does proxy so this could be a reason
f
or no sorry, static run on the same server, same ec2 instance
c
most likely they run on different ports
f
I have two spas, one that is hosted as a static asset (it is a dashboard for the server) and then I have an actual front end app that is hosted on S3, also a spa
I know the ec2 instance of ktor is running at port 5000, and it does work if I explicitly allow 
localhost:5000
through cors config
Do you understand the setup? Sorry if I am confusing you
c
I believe I do
f
Again, if I do not care about CORS at all, the ec2 instance with ktor running works fine with its staticly hosted spa, it can do requests against itself fine
c
could you please show me exact HTTP request details from browser's developer's console ?
f
Ktor responds with 403 when the self hosted spa tries to make requests
Cant provide screenshots right now sorry, will fix in a few hours
No CORS “installed” -> requests is fine
c
Yes, it would be very helpful to see more details: request and headers and response
f
CORS is “installed” to make another js client work -> same requests is a 403
yes alright, will come back in about an hour 🙂
thank you so much for your time so far!
c
It is important to notice which 
Origin
does it actually sends
f
I sent pictures in #ktor just now
c
I see. I believe we can add configurable same-origin logic to ktor as the specification doesn't forbid to do so
f
Hmm okay, so what is happening right now, it seems like the standard behavior is overriden when enabling CORS, when to me CORS should just be an addition, not changing what already works without it, what is happening?
c
well, it shouldn't be just an addition but a different behaviour described by the specification that doesn't require to always pass same-origin requests but makes it optional
f
Copy code
The default configuration to the CORS feature handles only GET, POST and HEAD HTTP methods and the following headers:
Is to be read in the documentation. I get a 403 from anything that is not that even on my own host 😕 I have to explicitly declare everything to get the old behavior back. Is that to be expected? What change do you propose and what can I do now, it seems like I have to explicitly declare the AWS elastic beanstalk host adress as well now to get PUT requests to work. I just want the statical asset js client to be able to do whatever it wants, just like before
So you mean that enabling CORS is now putting on more constraints on ALL requests? In that case an option to allow everything from the same host as the server is running on would be good yes
The same behavior as when CORS is not enabled
c
Yes, exactly. I am going to introduce option 
allowSameOrigin
. The only question is what default value it should have: should we allow same-origin requests by default or not
f
Okay, make sense, I probably know to little about CORS to be able to provide my opinion on that. To a noobie like me, enabling CORS is like enabling a protocol that enables external js clients to fire requests at your server, and you can then config which hosts should be able to do that. So to me it should allow same origin as default since it to me has little to do with what you enabled CORS for. If you by any chance have a js client hosted on the same origin I can not see a situation where you would want to choke that.
And besides even now the default configuration is still allowed, even for same origin, just not anything else
So it is not blocked, just semi-functional
c
It depends on 
Origin
header: when it is missing then it will be always passed
I don't know why does it actually send it for same-origin requests
f
Ahaaa, I see. So it is 
axios
fault? 😄
c
The other issue is that even if I allow same-origins, CORS will still block not-allowed http methods and headers
f
And why does it all work when CORS is not enabled? Because the default is to not allow external js clients to reach your server right? That is why CORS exists? If I don’t enable CORS my static asset spa works fine but my external js client cant fire requests against ktor. If I enable CORS I get this problem, the external js client can then do whatever request it wants, according to the config I allow, but not the self hosted spa. How do I get both to work with ktor 0.9.1 tonight? 😄
What is is CORS and then 
anyHost()
exactly? To me it seems like those cancel out, or should I just do that in the meantime? Its not a production system just a hobby project of mine so I dont really care as of now
c
You need to add "localhost:5000" and "yourdomain" to the list
You also may need to add more HTTP methods
as by default CORS only allows: 
HttpMethod.Get
, 
<http://HttpMethod.Post|HttpMethod.Post>
and 
HttpMethod.Head
f
I have added 
localhost:5000
and allowed PUT and DELETE. It works locally but when deployed to AWS EB it doesnt work. It seems like I need to add 
<http://XXX.region.elasticbeanstalk.com|XXX.region.elasticbeanstalk.com>
as well. Why is that needed, shouldn’t localhost be enough?
Its still localhost essentially that makes the request (the self hosted spa), why does it care where it is deployed? seems fragile
c
No, domain-comparison is quite strict
3 Views
Open in Slack
PreviousNext
Powered by