Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Apollo Server CORS whitelist #2596

Open
SachaG opened this issue Jul 1, 2020 · 3 comments
Open

Apollo Server CORS whitelist #2596

SachaG opened this issue Jul 1, 2020 · 3 comments

Comments

@SachaG
Copy link
Contributor

SachaG commented Jul 1, 2020

I tried specifying the apolloServer.corsWhitelist setting to enable Apollo Studio's Explorer to work. This worked well enough, but GraphQL requests coming from the app itself then started to fail until I explicitly added it.

I think even with the whitelist option specified, we should probably make an exception so that requests coming from the app always work?

@eric-burel
Copy link
Contributor

Are you up to date on devel? Will check but I indeed forgot same origin scenario in the first implementation. I think it's fixed in a recent commit.

@eric-burel
Copy link
Contributor

You should have this:

const corsOptions =
    corsWhitelist && corsWhitelist.length
      ? {
          origin: function(origin, callback) {
            if (!origin) callback(null, true); // same origin
            if (corsWhitelist.indexOf(origin) !== -1) {
              callback(null, true);
            } else {
              callback(new Error('Not allowed by CORS'));
            }
          },
        }
      : process.env.NODE_ENV === 'development';

The case "!origin" correspond to same-origin requests, so the app itself.

@eric-burel
Copy link
Contributor

I think I've reproduced that in Vulcan Meteor Next Transition, see sample settings: https://github.com/VulcanJS/Vulcan-Starter/blob/33a23bc3c22b6d5d73071d0b7f1c863f01149cc5/sample_settings.json
To be investigated by trying to query the Meteor app from itself, eg via graphql playground.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants