CORS pre-fetch not respecting per-route config

[jgauna]

I've been using HapiJs for some weeks and it's really great but I can't make it work with CORS. Right now I have method (POST) with:

        cors: {
            origin: ['*']
        },

And it's working great. I've added a new one (PUT) and it's not working:

XMLHttpRequest cannot load http://192.168.0.21:3000/updateOrder.... No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost' is therefore not allowed access. The response had HTTP status code 404

Also, I've opened this issue days ago in StackOverflow and didn't get any answer:

http://stackoverflow.com/questions/29424735/cant-use-authorization-in-hapi-js

Any ideas guys?

Thanks in advance

[MathieuLoutre]

It seems to be a configuration problem. Can you post some code? Have you tried cors: true?

[Marsup]

Hard to tell without more code.

[hueniverse]

Not enough information.

[dypsilon]

Just for the history: the problem here seems to be that the browser is trying to prefly the CORS request and sends an OPTIONS request. Which is answered by Hapi with a 404. The solution is to enable CORS for the entire connection. See this #2256

[Marsup]

I'd say having to enable CORS globally is not a good solution since you'd have to disable it on all the routes you don't want it on, this can lead to security issues.

[dypsilon]

@Marsup this is a fair comment. Is there any other way to have automatic preflights with 8.x?

[Marsup]

Based on

hapi/lib/connection.js

Lines 391 to 402 in 16c6373

	this._router.special('options', new Route({
	path: '/{p*}',
	method: 'options',
	config: {
	auth: false, // Override any defaults
	cors: this.settings.routes.cors,
	handler: function (request, reply) {
	return reply();
	}
	}
	}, this, this.server.realm));

, I'd say something similar to that : a route with the same path, method OPTIONS, your CORS, and just a reply should work. Maybe hapi should take care of that if a route has CORS but no global CORS, thoughts @hueniverse ?

[saidimu]

@hueniverse This issue needs to be re-opened? Based on this thread I see no way to have per-route CORS. As @Marsup mentioned, global CORS doesn't seem like a good idea.

[devinivy]

CORS should be configurable per connection and per route: http://hapijs.com/api#route-options

[saidimu]

This doesn't work in v10.3.0:

server.route({
  method: 'GET',
  path: '/books/get/{id?}',
  config: {
    cors: true,
  },
  handler: function(request, reply) {
    ...
  }
});