Preflight CORS requests are not hadled correctly

[izderadicka]

When using with --cors header and other web client, served from different location then API, and which sends preflight requests , then
OPTIONS preflight for /authenticate return 401 status,
thus
client/web browser cannot access the endpoint

OPTIONS requests handling has to be fixed in audioserve - especially when --cors switch is on.

[izderadicka]

Fix pushed to master

[izderadicka]

@KodeStar pls update here if it is working for you.

[KodeStar]

I’ve not tried it yet, been busy trying to add features and fix bugs, will try to build from master later today or tomorrow

[KodeStar]

Any chance you could put out a release with this change in it? It will be much easier for me to test.

[izderadicka]

@KodeStar - released latest master as v0.15.6. Can you confirm that CORS preflight is now working?

[KodeStar]

I think we have a success, it's not complaining about cors any longer, now I just have to work out why what I'm trying to send isn't working :)

[KodeStar]

Would it be possible to send the audioserve_token as a custom header instead of a cookie? The issue is, because the server and the frontend aren't on the same address it wont let me set the cookie. So all my subsequent requests to endpoints fail.

edit Nvm, I looked through the auth.rs code and realised it could be sent via an Authorization bearer token!

[izderadicka]

@KodeStar,
Yes you can use Bearer token as well as cookie. In browser you can you send cookie even to different host (if it was setup by that host). I'm using it in development of default client (as it is convenient and you don't have manage the header yourself). Just need to add this option to XHR withCredentials: true - see https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials

[KodeStar]

I was originally using axios and passing withCredentials: true but it didn't help, I have since got rid of axios and am just using fetch, I haven't tried it with that since I got it working by passing the bearer. However, when I tried it with axios I got this error in the browser https://imgur.com/Oa3C4go

This attempt to set a cookie via a Set-Cookie header was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response which was not the response to a top-level navigation.

[izderadicka]

@ Kodestar Hmm, this make sense - our cookie is now SameSite: Lax so it depends how login is initiated in browser. Problem is mainly for development, cause normally then client files and API are served from same location in production.
As I said it works for me now in FF for current client - probably the way login is initiated suits definition of "top-level navigation".

Anyhow if bearer token working for you it's good solution, as this will in both development and production set up. If there are still issues with CORS let me know, otherwise I think we can close this issue.

[KodeStar]

Agreed :)

[izderadicka]

CORS Headers looks working OK. However still some change needs to be done on cookie - created new issue fo this #64