Value of CORS header is false

[fastify]

Value of CORS header is false

[mcollina]

Would you like to send a Pull Request to address this issue? Remember to add unit tests.

[zekth]

Could you please specify the version of fastify-cors you're using?
Also please provide the request headers.

I cannot reproduce using:

fastify 3.15.0
fastify-cors 5.2.0

[zyrouge]

Could you please specify the version of fastify-cors you're using?
Also please provide the request headers.

I cannot reproduce using:

fastify 3.15.0
fastify-cors 5.2.0

It occurred while using v5.2.0, I'll try once again and try to identify the issue! :)

[Fdawgs]

@zyrouge do you have a public repo where this is occurring that you are able to share?

[zyrouge]

@zyrouge do you have a public repo where this is occurring that you are able to share?

Wish i could but its private :(

[zyrouge]

I reproduced it, check https://github.com/zyrouge/fastify-cors/tree/header-false for the code.

[zyrouge]

Assuming that the false value comes from

fastify-cors/index.js

Line 194 in 1385db3

return isRequestOriginAllowed(reqOrigin, originOption) ? reqOrigin : false

and browsers can't understand the false value and throws up a warning. According to https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin null value can be used but is not preferred, as a response with no header will be the solution?

[zekth]

false value means that the request is not allowed. Also you're not sharing the request headers, there is no way to reproduce it properly.

[zyrouge]

false value means that the request is not allowed. Also you're not sharing the request headers, there is no way to reproduce it properly.

I did some research and found that the cors header should only have a value of * or an origin. I don't think false is the appropriate value to be set. It still does the job but it would be nice if there is a solution to get rid of warnings displayed in the browser when using it. I'll make sure to share the request headers. :)

[zekth]

This need to be adressed in another issue.

Is your issue solved?

[zyrouge]

This need to be adressed in another issue.

Is your issue solved?

Fix for #127 would solve this.

[mcollina]

Fixed in v6.0.0