[bug/feature] CORS preflight request incorrectly handled

[akomm]

Q	A
Bug report?	yes
Feature request?	yes
BC Break report?	no
RFC?	no
Version/Branch	master

CORS preflight requests always fail with HTTP 400 response.

Overblog\GraphQLBundle\Controller\GraphController should check whether we have a CORS preflight request, before processing queries. This can be easily done checking whether the request method is 'OPTIONS'.

A CORS preflight request should result in an empty 200 response. So when we have method OPTIONS, return empty response and do not process queries. The empty response should also contain CORS headers. Maybe some defaults and configurable via extension.

[ste93cry]

Shouldn't a bundle like NelmioCorsBundle fix the problem?

[akomm]

You are right, I actually know this bundle and I used it in some other projects. I still think this bundle should simply return an empty response - at least. This is less confusing because you get better feedback that it was a preflight request, which failed due to missing fields, instead of 400. I know, you can see the OPTIONS method, but you might overlook it when you do not expect it and see 400. Why let an error occur?

[ste93cry]

I still think this bundle should simply return an empty response - at least

Although I agree with your opinion, I think that if there is already a bundle that handles CORS, then we shouldn't reinvent the wheel

[mcg-web]

I think we can recommends using NelmioCorsBundle like a good practice and implements a simple CORS generic answer with a way to disabled it. what do you think of that solution?

[akomm]

Sounds good :)

[mcg-web]

Merged on master, no release right now. the headers is not configurable and will not be in the future. the feature is disabled by default. For more flexibility NelmioCorsBundle is recommended...