How to set limited headers in CORS?

[hengyunabc]

How to set limited headers in CORS?

[timostamm]

You cannot include credentials with Access-Control-Allow-Origin: *. You have to allow specific origins instead.

This is unrelated to protobuf-ts - it's how browsers handle cross-origin requests. You will not be able to work around this with simple requests or no-cors mode.

[hengyunabc]

@timostamm Thank you for your reply.

Sorry, I made a mistake above. Setting Access-Control-Allow-Headers to * is not allowed.

Currently I set Access-Control-Allow-Origin to aaa.test.com.

I tested that if use the fetch api, you can specify headers and there will be no extra headers. At the same time, set Access-Control-Request-Headers: client-id on the server side, so that the server can handle the request correctly.

fetch("https://aaa.test.com/servic/method", {
   "headers": {
     "accept": "application/grpc-web-text",
     "client-id": "xxxx",
   }
   "

Is there any way to control headers when using protobuf-ts?

[timostamm]

At the same time, set Access-Control-Request-Headers: client-id on the server side, so that the server can handle the request correctly.

That's incorrect. Access-Control-Request-Headers is a header sent by the browser automatically for preflight requests.

You'll have to spend some time to read up on the documentation for CORS, run some examples yourself, and set up CORS correctly on your server. I highly recommend to use a CORS middleware if available.

The gRPC-web transport just uses fetch. It adds a couple of protocol-specific headers that you should not remove, otherwise your gRPC-web requests are broken. You can add your own headers via RPC options, see the manual.

[jcready]

@hengyunabc the grpc-web transport must set the Content-Type request header to application/grpc-web-text or application/grpc-web+proto. This is probably the bare minimum headers your server will need to respond with to work with CORS grpc-web requests:

Access-Control-Allow-Methods: OPTIONS, POST
Access-Control-Allow-Headers: accept, content-type, grpc-timeout, x-grpc-web
Access-Control-Expose-Headers: grpc-message, grpc-status

[hengyunabc]

Thanks for replies, I made a stupid mistake.

Access-Control-Request-Headers are sent by the browser to the server.

Access-Control-Allow-Headers is sent by the server to the browser.

The browser will send the following request header to the server:

Access-Control-Request-Headers: bx-v,cache-control,client-id,content-type,pragma,x-grpc-web

So server needs to return:

Access-Control-Allow-Headers: bx-v,cache-control,client-id,content-type,pragma,x-grpc-web

If Access-Control-Allow-Headers: * is returned, or Access-Control-Allow-Headers: client-id is returned, it will fail.