CORS problem in 1.1.0

[witcherofthorns]

CORS problem in 1.1.0

[witcherofthorns]

Okay, we can probably consider this problem solved for now, the most important thing is that CORS generally works, i'll try to come back to this problem later. Thank you @junekhan
Hey @gittiver, i think we can close this problem and revision #771

[witcherofthorns]

I dug a little into the source code, so far, this is the only crutch option to get CORS to work in v1.1.0. The problem is that the middleware CORSHandler does not work at all, I am still researching this issue and testing

source: routing.h

if (rules_matched)
{
    allow = allow.substr(0, allow.size() - 2);
    res = response(204);
    res.set_header("Allow", allow);
    res.end();
    found->method = method_actual;
    return found;
}

this work (crutch):

if (rules_matched)
{
    allow = allow.substr(0, allow.size() - 2);
    res = response(204);
    res.set_header("Allow", allow);
    res.add_header("Access-Control-Allow-Origin", "http://localhost:8080");
    res.add_header("Access-Control-Allow-Headers", "Origin, Content-Type, Accept");
    res.add_header("Access-Control-Allow-Methods", "*");
    res.add_header("Access-Control-Max-Age", "5");
    res.end();
    found->method = method_actual;
    return found;
}

I still have a feeling that something is wrong with the CORS middleware, because it doesn’t work at all, perhaps I don’t understand something, correct me if anything

source: cors.h

void before_handle(crow::request& /*req*/, crow::response& /*res*/, context& /*ctx*/) {
    CROW_LOG_DEBUG << "[CORS]: before_handle";
}

void after_handle(crow::request& req, crow::response& res, context& /*ctx*/) {
    CROW_LOG_DEBUG << "[CORS]: after_handle";
    auto& rule = find_rule(req.url);
    rule.apply(res);
}

But at the same time, any other middleware after a successful OPTIONS CORS request works without problems

source: my main.cpp

struct CORSTest {
    struct context{};

    void before_handle(crow::request& req, crow::response& res, context& ctx){
        CROW_LOG_INFO << "CORSTest before_handle";
    }

    void after_handle(crow::request& req, crow::response& res, context& ctx) {
        CROW_LOG_INFO << "CORSTest after_handle";
    }
};

I still haven't determined the reason for this behavior yet, but it seems to me that the problem lies somewhere in routing.h, I will try to look into this in more detail as soon as I have less work and more free time. If you know what the reason is, please reply to this message, thanks in advance

[gittiver]

Thanks for your investigation, I hadn't the time to look deeper into the issue.
unit test TEST_CASE("middleware_cors") checks only GET request.

[witcherofthorns]

#771 This almost completely fixes the problem, but I found a strange anomaly, it feels like the response is limited by the number of headers returned 4

[junekhan]

@witcherofthorns It's probably an issue on your side if your CORS configured exactly as

App<CORSHandler> app;
    auto &cors = app.get_middleware<CORSHandler>();
    cors.global()
        .origin("http://localhost:8080")               // frontend vue-js host
        .allow_credentials()                           // just in case
        .methods("POST"_method, "GET"_method);

you're then supposed to see

HTTP/1.1 204 No Content
Access-Control-Allow-Headers: Accept, Origin, Content-Type, Authorization
Access-Control-Allow-Methods: POST, GET
Access-Control-Allow-Origin: http://localhost:8080
Access-Control-Allow-Credentials: true

without Access-Control-Max-Age: 5.

Is it possible that you touched the Crow code and forgot to revert?

[witcherofthorns]

@junekhan Ok, check this and try send POST req
im using junekhan:bugfix/CORS-headers

App<CORSHandler> app;
auto &cors = app.get_middleware<CORSHandler>();
cors.global()
    .origin("http://localhost:8080")
    .headers(
        "Accept",
        "Origin",
        "Content-Type",
        "Authorization"
    )
    .allow_credentials()
    .max_age(10);

Yes, if you don’t specify max_age, then everything is fine