Enable CORS in Plumber #66

VinodPathak · 2016-12-19T08:57:53Z

I am trying to make a POST request through my chrome browser, but its showing error of preflight request.
Please suggest a way to enable CORS at Plumber side.

The text was updated successfully, but these errors were encountered:

SushantVarshney · 2016-12-19T09:32:11Z

I am also getting Response for preflight has invalid HTTP status code 404 when making POST request through chrome.

scottmmjackson · 2017-07-19T15:02:02Z

@trestletech may come up with a push-button solution at some point, but for now I'm pretty sure that you can totally do this:

#* @filter cors
cors <- function(res) {
    res$setHeader("Access-Control-Allow-Origin", "*") # Or whatever
    plumber::forward()
}

#* @preempt cors
#* @get /myroute
myRoute <- function() {
    # Do some CORS requests!
}

trestletech · 2017-07-19T21:26:10Z

I spent a little time looking into this today. The bad news is that it's going to get worse before it gets better. 😬

Two decisions:

The filter that @scottmmjackson suggests above is basically the default behavior for Plumber currently, and that feels like a security risk. So we'll be backing away from that behavior and prohibiting all CORS requests out of the box.
We should have a nice set of handlers that make it easy to be more permissive about CORS. As of Don't wildcard allow-origin by default. #144 Plumber now supports the OPTIONS verb, so you could in theory build a CORS-compliant service yourself, but it takes a lot of digging to get all the headers set correctly. We should wrap all that up in a nice filter that you could use easily in Plumber. So I'll leave this ticket open to represent that work.

joelgombin · 2017-08-28T00:04:05Z

For now does @scottmmjackson's approach still work in v0.4.0?

diplodata · 2018-02-26T00:18:29Z

@trestletech I wonder if there's been any activity or further thinking on this front? I'm hugely excited about plumber, but without CORS support it's much harder to harness its potential.

nuest · 2018-02-26T08:27:57Z

How about extending the advanced Docker example, which already has an nginx webserver, with code how to add CORS headers to an endpoint that nginx is a proxy for?

nginx as a web server is made for such tasks, and if you're really running an app in production you often run it behind a webserver (for https, for example) anyway.

nteetor · 2018-09-05T09:04:20Z

I think it's important to note that the workaround above did not work for me and at least one another. The modified example here, #143 (comment), with the @preempt line removed does work. Thank you, @joelgombin.

shizidushu · 2018-09-05T09:17:40Z

#' @filter cors
cors <- function(req, res) {
  
  res$setHeader("Access-Control-Allow-Origin", "*")
  
  if (req$REQUEST_METHOD == "OPTIONS") {
    res$setHeader("Access-Control-Allow-Methods","*")
    res$setHeader("Access-Control-Allow-Headers", req$HTTP_ACCESS_CONTROL_REQUEST_HEADERS)
    res$status <- 200 
    return(list())
  } else {
    plumber::forward()
  }
  
}

@nteetor Please try the above code. It is working for me

nteetor · 2018-09-05T09:36:09Z

Yes, I was able to get cors up and running, thank you though.

fdrennan · 2019-01-26T20:01:45Z

By simply adding the code provided by @shizidushu at the top of my plumber file, it solved this issue for me.

bala7123 · 2019-03-06T10:10:19Z

Hi. i am not able to resolve my cors issue. The cors function(req,res) solution provided by @shizidushu need any parameters ? I have the following code in my main R script.

r22 <- plumb("/script1.R")

r22$run(port=xxxx, host="x.x.x.x")

should i pass r22 or any other code to the function ? Please respond its urgent. thanks a ton

schloerke · 2019-03-13T15:00:43Z

@bala7123 the code provided by @shizidushu in #66 (comment) should exist within your /script1.R file.

kurt-o-sys · 2020-06-24T08:14:34Z

Thie solution given by #66 (comment) doesn't work for me: the filter is never called. I'm having programmatic routers (see code below). Whenver I request OPTIONS, the response is

{
    "error": [
        "404 - Resource Not Found"
    ]
}

My code:

router_logic <- plumber$new("R/route_logic.R")
router_info <- PlumberStatic$new("./public/info/")

router <- plumber$new()

#' @filter cors
cors <- function(req, res) {

  res$setHeader("Access-Control-Allow-Origin", "*")

  if (req$REQUEST_METHOD == "OPTIONS") {
    res$setHeader("Access-Control-Allow-Methods","*")
    res$setHeader("Access-Control-Allow-Headers", req$HTTP_ACCESS_CONTROL_REQUEST_HEADERS)
    res$status <- 200
    return(list())
  } else {
    plumber::forward()
  }

}

router$mount("/logic", router_logic)
router$mount("/public", router_info)
router$handle("GET", "/", function(req, res){
  include_file("./public/logic/DESCRIPTION", res, "text/plain")
})

#' @title startServer
#' @description Start the api server using environmental variable 'PORT', if not passed as an argument
#'
#' @param port port to bind the application to
#' @return none
#' @examples
#' #startServer()
#' @export
startServer <- function(port) {
  if (missing(port))
    port <- Sys.getenv("PORT")
  if (port == "")
    port <- "8000"
  router$run(host = '0.0.0.0',
             port = strtoi(port),
             swagger = function(pr_, spec, ...) {
               spec$info$title<-"..."
               spec$info$description<-"..."
               spec$info$version<-" 0.0.1"
               spec$servers[[1]]$description<-"..."
               spec
             })
}

schloerke · 2020-06-24T13:36:26Z

@kurt-o-sys

The filter must be added programmatically, if the router is also defined programatically.

(The #' @filter cors will not have any effect in your setup.)

Instead, add it directly:

router$filter("cors", cors)

kurt-o-sys · 2020-06-24T16:25:41Z

Aah, thanks! I thought is was something like that, but couldn't find it in the docs. I may have missed it... Solved.

AntonWijbenga · 2020-12-03T15:54:02Z

#' @filter cors
cors <- function(req, res) {
  
  res$setHeader("Access-Control-Allow-Origin", "*")
  
  if (req$REQUEST_METHOD == "OPTIONS") {
    res$setHeader("Access-Control-Allow-Methods","*")
    res$setHeader("Access-Control-Allow-Headers", req$HTTP_ACCESS_CONTROL_REQUEST_HEADERS)
    res$status <- 200 
    return(list())
  } else {
    plumber::forward()
  }
  
}

Thank you for this (see above). It works! Many solutions only state a simpler version like below:

res$setHeader("Access-Control-Allow-Origin", "*")
plumber::forward()

However, when calling the API with a JSON POST body and a header set explicitly to "content-type: application/json", this simpler version fails with a CORS error anyway. The more elaborate version by shizidushu, however, works!

Can someone explain what happens in the 'if' part? The request I described runs through the function twice (automatically). The first time only the 'if' part is executed, the second time the 'else'. How is this happening?

I do undertand the plumber::forward() command. But in the 'if' part an empty list is returned. How is it that the code-excution doesn't stop there? Plumber calls itself somehow?

meztez · 2020-12-03T21:29:12Z

Your client is calling plumber the second time with the headers set in the if.

If you do not do a plumber::forward(), plumber respond back to the client

AntonWijbenga · 2020-12-04T08:52:58Z

So.... because the header in the response to the client (browser side) is altered/set by the server (plumber side), the client, based on that 'new' header in the response resends its request using a different header? (which then ends up in the 'else' part).

meztez · 2020-12-04T09:11:13Z

Use your browser debugger to inspect browser traffic with your plumber server. You can see the headers from there.

https://developers.google.com/web/tools/chrome-devtools/network/

AntonWijbenga · 2020-12-04T10:36:06Z

Thanks meztez for pointing me in the right direction. I did inspect the browser debugger en saw that it it indeed sends two API calls when using the javascript 'fetch' method and setting Content-Type: application/json. Doing that triggers the browser to do a 'preflight' check using the OPTIONS request. After that succeeds, it does the POST request.

It is explained in more detail in this answer on stackoverflow:
https://stackoverflow.com/questions/46904400/why-do-i-get-an-options-request-after-making-a-post-request/46904470#46904470

That also explains why the more elaborate cors filter (as posted by @shizidushu) works and the simpler version (without the if/else) doesn't.

emilmahler · 2021-05-20T14:48:20Z

#' @filter cors
cors <- function(req, res) {
  
  res$setHeader("Access-Control-Allow-Origin", "*")
  
  if (req$REQUEST_METHOD == "OPTIONS") {
    res$setHeader("Access-Control-Allow-Methods","*")
    res$setHeader("Access-Control-Allow-Headers", req$HTTP_ACCESS_CONTROL_REQUEST_HEADERS)
    res$status <- 200 
    return(list())
  } else {
    plumber::forward()
  }
  
}

@nteetor Please try the above code. It is working for me

If you have two domains that you want to restrict CORS to, how do you do this? I've only seen examples with one address or *.

meztez · 2021-05-20T16:05:42Z

You could build something from this knowledge https://stackoverflow.com/questions/1653308/access-control-allow-origin-multiple-origin-domains.

Sounds like the recommended way to do it is to have your server read the Origin header from the client, compare that to the list of domains you would like to allow, and if it matches, echo the value of the Origin header back to the client as the Access-Control-Allow-Origin header in the response.

#' @filter cors
cors <- function(req, res) {
  
  if (req$HTTP_ORIGIN %in% c("domain1", "domain2") {

    res$setHeader("Access-Control-Allow-Origin", req$HTTP_ORIGIN)
  
    if (req$REQUEST_METHOD == "OPTIONS") {
      res$setHeader("Access-Control-Allow-Methods",req$HTTP_ORIGIN)
      res$setHeader("Access-Control-Allow-Headers", req$HTTP_ACCESS_CONTROL_REQUEST_HEADERS)
      res$status <- 200 
      return(list())
    } else {
      plumber::forward()
    }

  }
  
}

emilmahler · 2021-05-20T16:23:36Z

@meztez the value of req is <environment: 0x55c0d2c876d8> while req$HTTP_ORIGIN is null. In order to find this, I did:

# Enable CORS Filtering
#' @filter cors
cors <- function(req, res) {

  require(req)
  print(req)
  print(req$HTTP_ORIGIN)
  
  if (req$HTTP_ORIGIN %in% c("http://localhost:3000",
                             "https://testingdomain.com",
                             "https://productiondomain.com")) {
    
    res$setHeader("Access-Control-Allow-Origin", req$HTTP_ORIGIN)
    
    if (req$REQUEST_METHOD == "OPTIONS") {
      res$setHeader("Access-Control-Allow-Methods",req$HTTP_ORIGIN)
      res$setHeader("Access-Control-Allow-Headers", req$HTTP_ACCESS_CONTROL_REQUEST_HEADERS)
      res$status <- 200 
      return(list())
    } else {
      plumber::forward()
    }
  }
}

What am I missing?

meztez · 2021-05-20T17:12:42Z

Nothing. The code I provided was a mock, I'm not sure of the exact header that would contain the origin in your case.

yes req is an environment.

# Enable CORS Filtering
#' @filter cors
cors <- function(req, res) {

  # For debug/dev purpose remove when you find which header you need
  for (h in grep("^HTTP", ls(envir = req), value = TRUE)) { print(h); print(req[[h]])}
  
  if (req$HTTP_ORIGIN %in% c("http://localhost:3000",
                             "https://testingdomain.com",
                             "https://productiondomain.com")) {
    
    res$setHeader("Access-Control-Allow-Origin", req$HTTP_ORIGIN)
    
    if (req$REQUEST_METHOD == "OPTIONS") {
      res$setHeader("Access-Control-Allow-Methods",req$HTTP_ORIGIN)
      res$setHeader("Access-Control-Allow-Headers", req$HTTP_ACCESS_CONTROL_REQUEST_HEADERS)
      res$status <- 200 
      return(list())
    } else {
      plumber::forward()
    }
  }
}

emilmahler · 2021-05-20T19:27:31Z

There appears to be three variables it could be when HTTP_SEC_FETCH_MODE == "cors":

req$HTTP_REFERER
req$HTTP_HOST
req$REMOTE_ADDR

I went with the first, as follows:

# Enable CORS Filtering
#' @filter cors
cors <- function(req, res) {
  safe_domains <- c("http://localhost:3000",
                    "https://testingdomain.com",
                    "https://productiondomain.com")
  
  if (any(grepl(pattern = paste0(safe_domains,collapse="|"), req$HTTP_REFERER,ignore.case=T))) {
    res$setHeader("Access-Control-Allow-Origin", req$HTTP_REFERER)
    
    if (req$REQUEST_METHOD == "OPTIONS") {
      res$setHeader("Access-Control-Allow-Methods",req$HTTP_REFERER)
      res$setHeader("Access-Control-Allow-Headers", req$HTTP_ACCESS_CONTROL_REQUEST_HEADERS)
      res$status <- 200
      return(list())
    } else {
      plumber::forward()
    }
  }
}

Looking at Mozilla cors docs, it looks like the origin is the base domain while the referer is the full path.

emilmahler · 2021-05-21T07:51:34Z

The above solution is unstable, and you can never see the swagger documentation. Right now I have this working solution (implemented without fully understanding plumber::forward()):

# Enable CORS Filtering
#' @filter cors
cors <- function(req, res) {
  safe_domains <- c("http://localhost:3000",
                    "https://testingdomain.com",
                    "https://productiondomain.com")
  
  if (any(grepl(pattern = paste0(safe_domains,collapse="|"), req$HTTP_REFERER,ignore.case=T))) {
    res$setHeader("Access-Control-Allow-Origin", sub("/$","",req$HTTP_REFERER)) #Have to remove last slash, for some reason
    
    if (req$REQUEST_METHOD == "OPTIONS") {
      res$setHeader("Access-Control-Allow-Methods","GET,HEAD,PUT,PATCH,POST,DELETE") #This is how node.js does it
      res$setHeader("Access-Control-Allow-Headers", req$HTTP_ACCESS_CONTROL_REQUEST_HEADERS)
      res$status <- 200
      return(list())
    } else {
      plumber::forward()
    }
  } else {
    plumber::forward()
  }
}

philibe · 2023-06-21T12:15:58Z

As @schloerke said in #604 "CORS implementation" (Jul 21, 2020), to enable CORS he recommended the code of the comment of @shizidushu on Sep 5, 2018 in this current issue. (Thanks @shizidushu). (It works for me).

But before that I had missed the use of #* @preempt cors and finally re-read the doc.

@preempt is not like a decorator to activate the cors() function, it's to disable cors() for some endpoints because this filter cors() function is actived for all the endpoints of the plumber service launched.

Once this filter is defined, each endpoint will allow “cross-domain” requests. It’s possible to disable it for some, by appending the line #* @preempt cors before the declaration of a function like this :
#* @preempt cors
#* @get /sub
cors_disabled <- function(a, b){
as.numeric(a) - as.numeric(b)
}
Understand that, this is a temporary workaround and can constitute critical security issues if some endpoints that shouldn’t be exposed through CORS and have been enabled by default.

from https://www.rplumber.io/articles/security.html#cross-origin-resource-sharing-cors

ncullen93 · 2023-10-28T21:49:06Z

So funny that I just did the same thing ^ spent 30 minutes trying all of this until I really read the last comment and realized you have to TAKE AWAY #* @preempt cors to get it to work. Counter-intuitive, but now it works!

trestletech added the type: bug Maintainers have validated that it is a real bug in the project code label Jun 13, 2017

trestletech added this to the v1.0 milestone Jun 13, 2017

trestletech modified the milestones: v0.5.0, 0.4.0 Jul 7, 2017

trestletech removed this from the 0.4.0 milestone Jul 19, 2017

joelgombin added a commit to CMARUE/APIs that referenced this issue Aug 28, 2017

Allow cross-domain requests, as per rstudio/plumber#66

c29de5c

joelgombin mentioned this issue Sep 3, 2017

Don't allow-origins * by default #143

Closed

trestletech added this to the v0.4.4 milestone Oct 16, 2017

joelgombin added a commit to CMARUE/APIs that referenced this issue Oct 23, 2017

Allow cross-domain requests, as per rstudio/plumber#66

36723ce

This was referenced Nov 8, 2017

Question: Nuxt or Angular + Plumber? #193

Closed

CORS Feature & Documentation #210

Closed

trestletech modified the milestones: v0.4.4, v0.4.5 Nov 15, 2017

schloerke modified the milestones: v0.4.6, v0.4.8 - Next CRAN release, future - v0.5.0 Dec 7, 2018

schloerke added docs Related to documentation only and removed type: bug Maintainers have validated that it is a real bug in the project code labels Dec 12, 2018

dmenne mentioned this issue Apr 3, 2019

@filter cors for DELETE #409

Open

schloerke mentioned this issue May 29, 2019

github/mailgun example in the web have cors issue #442

Closed

This was referenced Jul 15, 2020

Tidy plumber API #590

Merged

CORS implementation #604

Open

Kvit mentioned this issue Feb 12, 2023

Connection is closed on OPTIONS requests #276

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable CORS in Plumber #66

Enable CORS in Plumber #66

VinodPathak commented Dec 19, 2016

SushantVarshney commented Dec 19, 2016

scottmmjackson commented Jul 19, 2017

trestletech commented Jul 19, 2017

joelgombin commented Aug 28, 2017

diplodata commented Feb 26, 2018

nuest commented Feb 26, 2018

nteetor commented Sep 5, 2018 •

edited

Loading

shizidushu commented Sep 5, 2018

nteetor commented Sep 5, 2018

fdrennan commented Jan 26, 2019

bala7123 commented Mar 6, 2019 •

edited

Loading

schloerke commented Mar 13, 2019

kurt-o-sys commented Jun 24, 2020

schloerke commented Jun 24, 2020

kurt-o-sys commented Jun 24, 2020

AntonWijbenga commented Dec 3, 2020 •

edited

Loading

meztez commented Dec 3, 2020 •

edited

Loading

AntonWijbenga commented Dec 4, 2020

meztez commented Dec 4, 2020

AntonWijbenga commented Dec 4, 2020

emilmahler commented May 20, 2021

meztez commented May 20, 2021 •

edited

Loading

emilmahler commented May 20, 2021 •

edited

Loading

meztez commented May 20, 2021 •

edited

Loading

emilmahler commented May 20, 2021

emilmahler commented May 21, 2021 •

edited

Loading

philibe commented Jun 21, 2023 •

edited

Loading

ncullen93 commented Oct 28, 2023

Enable CORS in Plumber #66

Enable CORS in Plumber #66

Comments

VinodPathak commented Dec 19, 2016

SushantVarshney commented Dec 19, 2016

scottmmjackson commented Jul 19, 2017

trestletech commented Jul 19, 2017

joelgombin commented Aug 28, 2017

diplodata commented Feb 26, 2018

nuest commented Feb 26, 2018

nteetor commented Sep 5, 2018 • edited Loading

shizidushu commented Sep 5, 2018

nteetor commented Sep 5, 2018

fdrennan commented Jan 26, 2019

bala7123 commented Mar 6, 2019 • edited Loading

schloerke commented Mar 13, 2019

kurt-o-sys commented Jun 24, 2020

schloerke commented Jun 24, 2020

kurt-o-sys commented Jun 24, 2020

AntonWijbenga commented Dec 3, 2020 • edited Loading

meztez commented Dec 3, 2020 • edited Loading

AntonWijbenga commented Dec 4, 2020

meztez commented Dec 4, 2020

AntonWijbenga commented Dec 4, 2020

emilmahler commented May 20, 2021

meztez commented May 20, 2021 • edited Loading

emilmahler commented May 20, 2021 • edited Loading

meztez commented May 20, 2021 • edited Loading

emilmahler commented May 20, 2021

emilmahler commented May 21, 2021 • edited Loading

philibe commented Jun 21, 2023 • edited Loading

ncullen93 commented Oct 28, 2023

nteetor commented Sep 5, 2018 •

edited

Loading

bala7123 commented Mar 6, 2019 •

edited

Loading

AntonWijbenga commented Dec 3, 2020 •

edited

Loading

meztez commented Dec 3, 2020 •

edited

Loading

meztez commented May 20, 2021 •

edited

Loading

emilmahler commented May 20, 2021 •

edited

Loading

meztez commented May 20, 2021 •

edited

Loading

emilmahler commented May 21, 2021 •

edited

Loading

philibe commented Jun 21, 2023 •

edited

Loading