CORS headers missing

[leonixyz]

Environment

• PostgreSQL version: docker latest - Image ID 07e2ee723e2d
• PostgREST version: docker latest - Image ID 544cf655419b
• Operating system: Arch Linux

# docker images
REPOSITORY                     TAG          IMAGE ID       CREATED        SIZE
postgres                       latest       07e2ee723e2d   2 months ago   374MB
postgrest/postgrest            latest       544cf655419b   4 months ago   16.3MB

$ uname -a
Linux gear 5.16.12-arch1-1 #1 SMP PREEMPT Wed, 02 Mar 2022 12:22:51 +0000 x86_64 GNU/Linux

Description of issue

The doc states:

PostgREST sets highly permissive cross origin resource sharing, that is why it accepts Ajax requests from any domain.

It seems however, that no Access-Control-Allow-* headers are actually sent

$ curl -vvv http://localhost:3000/user
*   Trying 127.0.0.1:3000...
* Connected to localhost (127.0.0.1) port 3000 (#0)
> GET /user HTTP/1.1
> Host: localhost:3000
> User-Agent: curl/7.81.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Transfer-Encoding: chunked
< Date: Sun, 06 Mar 2022 21:08:54 GMT
< Server: postgrest/9.0.0
< Content-Range: 0-2/*
< Content-Location: /user
< Content-Type: application/json; charset=utf-8
< 
[]

docker-compose.yml

version: '3'
services:

  db:
    image: postgres
    ports:
      - "5432:5432"
    environment:
      POSTGRES_DB: app_db
      POSTGRES_USER: app_user
      POSTGRES_PASSWORD: password
    volumes:
      - "./pgdata:/var/lib/postgresql/data"

  postgrest:
    image: postgrest/postgrest
    ports:
      - "3000:3000"
    environment:
      PGRST_DB_URI: postgres://app_user:password@db:5432/app_db
      PGRST_DB_SCHEMA: public
      PGRST_OPENAPI_SERVER_PROXY_URI: http://127.0.0.1:3000
    depends_on:
      - db

[wolfgangwalther]

The CORS headers are set on a preflight request, not on the regular request. What you are showing is the output of the regular request.

You can see the CORS headers in the following request:

curl -H "Origin: http://example.com" \
  -H "Access-Control-Request-Method: POST" \
  -X OPTIONS --verbose \
  http://localhost:3000

*   Trying 127.0.0.1:3000...
* Connected to localhost (127.0.0.1) port 3000 (#0)
> OPTIONS / HTTP/1.1
> Host: localhost:3000
> User-Agent: curl/7.82.0
> Accept: */*
> Origin: http://example.com
> Access-Control-Request-Method: POST
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Transfer-Encoding: chunked
< Date: Tue, 08 Mar 2022 07:57:06 GMT
< Server: postgrest/9.0.0.20220211 (pre-release) (dcf7ade)
< Access-Control-Allow-Origin: http://example.com
< Access-Control-Allow-Credentials: true
< Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE, OPTIONS, HEAD
< Access-Control-Max-Age: 86400

[leonixyz]

Hello,

After your previous answer, I did not had the time to investigate why I keep getting the error of the Access-Control-Allow-* headers missing, which was actually returned by swagger, and it's the reason why I did open the issue.

Anyway, here is my setup: I prefer not to bind all services on the host ports, like the docker-compose file in the doc does.

I prefer to setup an nginx www reverse proxy used as ingress.

I remember trying adding the headers in the nginx config, but unsuccessfully, but I have to retry when I have more time.

docker-compose.yml

version: '3'
services:

  db:
    image: postgres
    expose:
      - "5432"
    environment:
      POSTGRES_DB: app_db
      POSTGRES_USER: app_user
      POSTGRES_PASSWORD: password
    volumes:
      - "./pgdata:/var/lib/postgresql/data"

  pgadmin:
    image: dpage/pgadmin4
    expose:
      - "8000"
    environment:
      PGADMIN_DEFAULT_EMAIL: user@domain.com
      PGADMIN_DEFAULT_PASSWORD: password
      PGADMIN_DISABLE_POSTFIX: true
      PGADMIN_LISTEN_PORT: 8000
    depends_on:
      - db

  postgrest:
    image: postgrest/postgrest
    expose:
      - "3000"
    environment:
      PGRST_DB_URI: postgres://app_user:password@db:5432/app_db
      PGRST_DB_SCHEMA: public
      PGRST_DB_ANON_ROLE: app_user 
      PGRST_OPENAPI_SERVER_PROXY_URI: http://localhost/api/
      PGRST_JWT_SECRET: SecretSecretSecretSecretSecretSecret
    depends_on:
      - db

  swagger:
    image: swaggerapi/swagger-ui
    expose:
      - "8080"
    environment:
      API_URL: /api/
    depends_on:
      - postgrest

  www:
    image: nginx
    ports:
      - "80:80"
    volumes:
      - "./html:/usr/share/nginx/html:ro"
      - "./nginx.default.conf:/etc/nginx/conf.d/default.conf:ro"
    depends_on:
      - postgrest
      - pgadmin
      - swagger

nginx.default.conf

upstream postgrest {
    server   postgrest:3000;
}
upstream swagger {
    server   swagger:8080;
}
upstream pgadmin {
    server   pgadmin:8000;
}

server {
    listen       80;
    listen  [::]:80;
    server_name  localhost;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }

    error_page  404              /404.html;
    error_page  500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    location /api/ {
        proxy_pass   http://postgrest/;
    }

    location /swagger/ {
        proxy_pass   http://swagger/;
    }

    location /pgadmin/ {
        proxy_set_header X-Script-Name /pgadmin;
        proxy_pass   http://pgadmin/;
    }
}

[wolfgangwalther]

After your previous answer, I did not had the time to investigate why I keep getting the error of the Access-Control-Allow-* headers missing, which was actually returned by swagger, and it's the reason why I did open the issue.

Can you show the exact request you're making and the exact error response, too?

[leonixyz]

I could not do any request via swagger, because it fails fetching the openapi document. The error is shown directly when you open swagger in the browser