RcpServer: Fixed CORS and Basic Auth

[cschuchardt88]

closes #811

Change Log

• Fixed basic auth to work now, and popup auth window in browser
• Fixed CORS with basic auth
• Added AllowOrigins for basic auth to work (config.json)

[vncoelho]

We are facing some CORS issue using Gitpod.

I tried to re-route C# RPC Plugin with express node, using Axios to make the post request.
Then it worked. The Gitpod behaved normally withour CORS problems.

I am not understanding why the browser is having issues with the request directly to the RPC plugin.

The strange situation is that this just happens when there are multiple requests. Let's say 5 requests per second.

[cschuchardt88]

Some stuff to note here is the KeepAliveTimeout is hard coded to 1 minute and the max allow concurrent connections is configurable in the config.json aka open connections. More than likely the browser is sending Keep-Alive header. But note CORS specification states that setting origins to "*" (all origins) is invalid if the Access-Control-Allow-Credentials header is present aka basic authentication headers & cookies.

But if you could elaborate a little bit more. Like what is C# RPC Plugin? RpcClient? Also did this PR fix the issue at hand? Your having another issue with multi-requests per second? with or without the code changes?

[vncoelho]

@cschuchardt88, considering your comment it was found that MaxConcurrentConnections was the problem for our case.
The good part is that I tested this PR in different scenarios.

For me it is ready.

Thanks for you attention.

[vncoelho]

Maybe we can also move KeepAliveTimeout and RequestHeadersTimeout to config.

                // Default value is 1 minutes
                options.Limits.KeepAliveTimeout = TimeSpan.FromMinutes(1);
                // Default value is 15 seconds
                options.Limits.RequestHeadersTimeout = TimeSpan.FromSeconds(15);

[cschuchardt88]

do you want that in seconds or minutes for KeepAliveTimeout, also should CORS be enabled by default?

[cschuchardt88]

Also something we may want to consider in the future is "Enable forward proxies"; will help with web hosting and cloud stuff.

[vncoelho]

I think the PR should keep the same behavior as nowadays, @cschuchardt88.

Parameters could be in seconds.

Regarding or issue about the neo-cli handling all this configurations, that is also a possibility for the future that we should consider.

[vncoelho]

Also something we may want to consider in the future is "Enable forward proxies"; will help with web hosting and cloud stuff.

sure!

[vncoelho]

@superboyiii ,can you test?

[vncoelho]

ping @superboyiii

[cschuchardt88]

Any update on this @superboyiii ? Just fyi, this fixes a bug in the wild.