CORS support

[piranna]

Could it be possible to add a flag to enable CORS support? Does it makes sense, or is there any other way to have CORS support with fastify-cli? Is it only possible to have CORS support by creating an ad-hoc server?

[mcollina]

Can you please articulate your use case a bit more? Why do you need this? Normally plugins are added as dependencies and loaded with register.

[cemremengu]

@piranna you can use https://github.com/fastify/fastify-cors

[piranna]

Can you please articulate your use case a bit more? Why do you need this?

I created the server with fastify generate and just wanted to not opt-out to have a standalone server, but instead to use fastify start, nor add server specific code to the plugins. Later I remember about the app.js file that I totally forgot, so the plugin can be added there. The problem I'm having now is that fastify-cors is not working for me. This is my app.js file:

'use strict'

const path = require('path')

const AutoLoad = require('fastify-autoload')
const fastifyCORS = require('fastify-cors')
const fastifySSE = require('fastify-sse')
const mongoose = require('mongoose')


module.exports = function (fastify, opts, next) {
  // Place here your custom code!
  mongoose.connect(process.env.mongodb)

  fastify.register(fastifyCORS)
  fastify.register(fastifySSE)

  // Do not touch the following lines

  // This loads all plugins defined in plugins
  // those should be support plugins that are reused
  // through your application
  fastify.register(AutoLoad, {
    dir: path.join(__dirname, 'plugins'),
    options: Object.assign({}, opts)
  })

  // This loads all plugins defined in services
  // define your routes in one of these
  fastify.register(AutoLoad, {
    dir: path.join(__dirname, 'services'),
    options: Object.assign({}, opts)
  })

  // Make sure to call next when done
  next()
}

[mcollina]

The above should work for you, how is that not working for you?

[piranna]

I still get cors errors in browser. Not sure if related to being using localhost...

[mcollina]

Can you reproduce the problem with just fastify and fastify-cors?

[piranna]

Do you think it could be related to the usage of fastify-sse and/or doing the request from an EventSource?

[mcollina]

that might be related Il giorno gio 10 gen 2019 alle 00:00 Jesús Leganés-Combarro < notifications@github.com> ha scritto:

…

Do you think it could be related to the usage of fastify-sse and/or doing the request from an EventSource? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#147 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AADL44gDxFS1MrkK33NHGyKhbNrg9JfPks5vBnSUgaJpZM4Z3zIN> .

[piranna]

Lefting just only fastify and fastify-cors is still happening:

Access to resource at 'http://localhost:3000/rooms/a/participants/b/sse' from origin 'http://localhost:3001' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

The response was a 400 error because parameters where wrong, and by removing their pattern from the parameters validation, now CORS is working correctly. Maybe fastify-cors is not adding the CORS headers when schema validation fails?

{
    schema: {
      params: {
        participant: {
//          pattern: '^[0-9a-fA-F]{24}$',
          type: 'string'
        },
        room: {
//          pattern: '^[0-9a-fA-F]{24}$',
          type: 'string'
        }
      }
    }
  }

[mcollina]

You are trying to access localhost:3000 from localhost:3001, which is a violation of the default cors policies. Is your UI running on localhost:3001? You should just disable cors in development.

[piranna]

You are trying to access localhost:3000 from localhost:3001, which is a violation of the default cors policies. Is your UI running on localhost:3001?

Yes, that's on purposse, I have server running in 3000 and a SPA served from 3001, that's why I need cors here.

At least now is working, but with schema validation disabled, if I enabled it again fastify-cors fail to send the cors headers. I'll try to investigate on that later if you don't have a clue about this.

[piranna]

Finally found the problem. fastify-cors 1.0 uses the preHandler hook, while 2.0 uses preValidation, but requires to use fastify 2.0.0-rc.3. After upgrading the dependencies (and changing version compatible in fastify-sse) now CORS headers are send also when validation fails.