Problem with CORS support

[dherault]

Problem with CORS support

[dherault]

Hi @alshamma, I'll look into it. @vmadman what do you think?

@alshamma Can you test each header separately to see which one is blocking?

[alshamma]

@dherault The error message from Chrome indicates that the "Origin" header is not accepted. But, Firefox sends Origin. Here is the list of headers that Firefox sends:

Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.5
Accept: */*
Authorization: xxx
Connection: keep-alive
DNT: 1
Host: localhost.editinps.com:3000
Origin: https://localhost.editinps.com:3001
Referer: https://localhost.editinps.com:3001/dashboard
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:46.0) Gecko/20100101 Firefox/46.0

And the response in Firefox:

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://localhost.editinps.com:3001
Cache-Control: no-cache
Connection: keep-alive
Content-Encoding: gzip
Content-Type: application/json; charset=utf-8
Date: Thu, 02 Jun 2016 15:29:35 GMT
Transfer-Encoding: chunked
Vary: origin,accept-encoding
access-control-expose-headers: WWW-Authenticate,Server-Authorization

For Chrome, I can only see the headers sent on OPTIONS, which succeeds. It is the GET that fails:

Accept-Encoding: gzip, deflate, sdch, br
Accept-Language: en-US,en;q=0.8
Accept: */*
Access-Control-Request-Headers: accept, authorization
Access-Control-Request-Method: GET
Cache-Control: no-cache
Connection: keep-alive
DNT: 1
Host: localhost.editinps.com:3000
Origin: https://localhost.editinps.com:3001
Pragma: no-cache
Referer: https://localhost.editinps.com:3001/dashboard
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.63 Safari/537.36

For some reason, I can't see the OPTIONS for this particular call in Firefox, but I do see it in Chrome.

Do you have experience with Charles Proxy? I've set a breakpoint for the GET call to https://localhost.editinps.com:3000. It hits the breakpoint on OPTIONS and GET when I execute from Firefox but nothing at all from Chrome.

[alshamma]

I found what appears to be the problem. Chrome sends the "Referer" header in OPTIONS and Firefox does not. As a result, offline does not send the CORS Access-Control-xxx headers in the OPTIONS response to Chrome.

The workaround is to add referer to --corsAllowHeaders.

[alshamma]

Yikes, it was working while Charles Proxy was running, but stopped working after reboot. Debugging some more.