Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cors AllowWildcard never set - Wildcard origins not taken into account #879

Open
YassineElbouchaibi opened this issue Jun 20, 2024 · 1 comment
Labels
internally-reviewed The issue has been reviewed internally.

Comments

@YassineElbouchaibi
Copy link
Contributor

YassineElbouchaibi commented Jun 20, 2024

router v0.92.3

Description

Using only a config.yaml to setup the router, it is impossible to make use of wildcards in cors.allow_origins as AllowWildcard is never set and therefore parseWildcardRules() doesn't pickup any rules.

Steps to Reproduce

Start a router with the following in the config:

cors:
  allow_origins: [http://*]
  allow_headers: ["*"]
  allow_credentials: true

Use chrome to make a fetch request to your router and you will get 403 Forbidden in the OPTIONS request.

Expected Result

OPTIONS request should go through

Actual Result

403 Forbidden in the OPTIONS request

Useful links

Using only a config.yaml to setup the router, it is impossible to make use of wildcards in cors.allow_origins as AllowWildcard is never set and therefore parseWildcardRules() doesn't pickup any rules.

Steps to Reproduce

Start a router with the following in the config:

cors:
  allow_origins: [http://*]
  allow_headers: ["*"]
  allow_credentials: true

Use chrome to make a fetch request to your router and you will get 403 Forbidden in the OPTIONS request.

Expected Result

OPTIONS request should go through

Actual Result

403 Forbidden in the OPTIONS request

Useful links

Config

version: '1'
 
dev_mode: true
router_config_path: config.json
graph:
  token: ''
 
listen_addr: 0.0.0.0:3002
 
graphql_path: '/'
 
headers:
  all:
    request:
      - op: 'propagate'
        named: authorization
      - op: 'propagate'
        named: Cookie
      - op: 'propagate'
        named: origin
 
cors:
  allow_origins: [http://*]
  allow_headers: ["*"]
  allow_credentials: true
 
telemetry:          
  prometheus:
    enabled: false # Side node: disabling prometheus doesn't work too
Copy link

WunderGraph commits fully to Open Source and we want to make sure that we can help you as fast as possible.
The roadmap is driven by our customers and we have to prioritize issues that are important to them.
You can influence the priority by becoming a customer. Please contact us here.

@StarpTech StarpTech added the internally-reviewed The issue has been reviewed internally. label Jul 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
internally-reviewed The issue has been reviewed internally.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants