Getting CORS error when I use route /v1/graphql

[swapnil2525kangralkar]

I am trying to limit /v1/graphql with ip but I am getting CORS error.
If route /v1 is used no error but api limit does not work.
/v1/*, /v1* these are also not working.

Checking on localhost with docker-compose.

Please check below Caddyfile:

:8080 {
  reverse_proxy graphql-engine:8080
  route /v1/graphql {
        rate_limit {remote.ip} 50r/m

        respond 200
    }
}

[RussellLuo]

@swapnil2525kangralkar With the Caddyfile you provided, I got the corresponding config in JSON as below:

{
  "apps": {
    "http": {
      "servers": {
        "srv0": {
          "routes": [
            {
              "handle": [
                {
                  "routes": [
                    {
                      "handle": [
                        {
                          "rate": "50r/m", 
                          "handler": "rate_limit", 
                          "key": "{remote.ip}"
                        }
                      ]
                    }, 
                    {
                      "handle": [
                        {
                          "status_code": 200, 
                          "handler": "static_response"
                        }
                      ]
                    }
                  ], 
                  "handler": "subroute"
                }
              ], 
              "match": [
                {
                  "path": [
                    "/v1/graphql"
                  ]
                }
              ]
            }, 
            {
              "handle": [
                {
                  "handler": "reverse_proxy", 
                  "upstreams": [
                    {
                      "dial": "graphql-engine:8080"
                    }
                  ]
                }
              ]
            }
          ], 
          "listen": [
            ":8080"
          ]
        }
      }
    }
  }
}

By changing the rate to 5r/m, rate_limit is confirmed to be effective for me:

$ curl -w "%{http_code}" 'http://localhost:8080/v1/graphql' 
200
$ curl -w "%{http_code}" 'http://localhost:8080/v1/graphql' 
200
$ curl -w "%{http_code}" 'http://localhost:8080/v1/graphql' 
200
$ curl -w "%{http_code}" 'http://localhost:8080/v1/graphql' 
200
$ curl -w "%{http_code}" 'http://localhost:8080/v1/graphql' 
200
$ curl -w "%{http_code}" 'http://localhost:8080/v1/graphql' 
429

[swapnil2525kangralkar]

@swapnil2525kangralkar With the Caddyfile you provided, I got the corresponding config in JSON as below:

{
  "apps": {
    "http": {
      "servers": {
        "srv0": {
          "routes": [
            {
              "handle": [
                {
                  "routes": [
                    {
                      "handle": [
                        {
                          "rate": "50r/m", 
                          "handler": "rate_limit", 
                          "key": "{remote.ip}"
                        }
                      ]
                    }, 
                    {
                      "handle": [
                        {
                          "status_code": 200, 
                          "handler": "static_response"
                        }
                      ]
                    }
                  ], 
                  "handler": "subroute"
                }
              ], 
              "match": [
                {
                  "path": [
                    "/v1/graphql"
                  ]
                }
              ]
            }, 
            {
              "handle": [
                {
                  "handler": "reverse_proxy", 
                  "upstreams": [
                    {
                      "dial": "graphql-engine:8080"
                    }
                  ]
                }
              ]
            }
          ], 
          "listen": [
            ":8080"
          ]
        }
      }
    }
  }
}

By changing the rate to 5r/m, rate_limit is confirmed to be effective for me:

$ curl -w "%{http_code}" 'http://localhost:8080/v1/graphql' 
200
$ curl -w "%{http_code}" 'http://localhost:8080/v1/graphql' 
200
$ curl -w "%{http_code}" 'http://localhost:8080/v1/graphql' 
200
$ curl -w "%{http_code}" 'http://localhost:8080/v1/graphql' 
200
$ curl -w "%{http_code}" 'http://localhost:8080/v1/graphql' 
200
$ curl -w "%{http_code}" 'http://localhost:8080/v1/graphql' 
429

[swapnil2525kangralkar]

Thanks @RussellLuo,
Checked - working on curl on my side also.
I will recheck all configs why it is not working on brower.
Might be some other issue.
For now closing will update if anything related.

[RussellLuo]

I am trying to limit /v1/graphql with ip but I am getting CORS error.
If route /v1 is used no error but api limit does not work.

CORS is a browser-related mechanism, see here for details.

I guess that you have configured CORS headers for upstream graphql-engine:8080, but not for /v1/graphql. Try this Caddyfile instead:

:8080 {
  reverse_proxy graphql-engine:8080
  route /v1/graphql {
    rate_limit {remote.ip} 50r/m

    # CORS headers
    header Access-Control-Allow-Origin *
    header Access-Control-Allow-Methods GET
    header Access-Control-Allow-Credentials true

    respond 200
  }
}

[swapnil2525kangralkar]

For anyone who needs to setup hasura graphql and caddy 2.0 with ratelimit ext (docker-compose).

• Default: 120r/min for ip address.
• custom caddy 2.0 docker image with caddy extension.

Github: https://github.com/swapnil2525kangralkar/caddy_hasura_ratelimit

[ermiaqasemi]

I also get a CORS error when the limit happens, actually, first 100 request are ok until the user reaches the rate limit and it shows CORS error, any idea?

[RussellLuo]

Per the doc of Preflighted requests:

Unlike “simple requests” (discussed above), for "preflighted" requests the browser first sends an HTTP request using the OPTIONS method to the resource on the other origin, in order to determine if the actual request is safe to send.

So if the OPTIONS request is limited, then you will encounter a CORS error. Try to just limit the actual request by using the method matcher.