CORS

[af1964]

I am building a simple OTA system for ESP32. This is the simple code of the server. The OPTIONS request does'nt work properly (see the joined image). CORS is not taken in care OPTIONS. Leatest version of microdot (2.07).

import network
import urequests
import time
import machine
from microdot import Microdot,Response
from microdot.cors import CORS

# Configuration Wi-Fi et OTA
WIFI_SSID = ""
WIFI_PASSWORD = ""
SERVER_URL = "http://192.168.1.59/Projets/OTA"  # Remplacez par l'adresse IP du serveur OTA
ESP_IP = None


app = Microdot()
CORS(app,allowed_origins=[SERVER_URL], allow_credentials=True,handle_cors=True)


# Gérer les requêtes OPTIONS pour /download
@app.route('/download', methods=['OPTIONS'])
def options_handler(request):
    print("Requête OPTIONS reçue sur /download")
    response = Response('', 204)
    return response


# Route principale pour POST
@app.route('/download', methods=['POST','OPTIONS'])
def download_file(request):
    file_name = request.json.get("file")
    print(f"Requête POST reçue pour le fichier : {file_name}")
    return {"status": "success", "message": f"Fichier {file_name} traité"}, 200

if __name__ == "__main__":
    print("Serveur en cours d'exécution...")
    app.run(host="0.0.0.0", port=80)

[miguelgrinberg]

Not sure if this is the issue, but your allowed origin should not be the complete URL of your endpoint you need to remove the path part. The origin should be "http://192.168.1.59" in this case.

[af1964]

Makes the change. Same result. Try to replace with '*' same result normally will be 204 but is 200. Curl results :
PS C:\Users\afory> curl -X POST -H "Content-Type: application/json" -d '{"file": "test.py"}' http://192.168.1.71/download
{"message": "Fichier test.py téléchargé", "status": "success"}
PS C:\Users\afory> curl -X OPTIONS -I http://192.168.1.71/download
HTTP/1.0 200 OK
Allow: OPTIONS, POST, OPTIONS
Content-Length: 0
Content-Type: application/json; charset=UTF-8

[miguelgrinberg]

Try this:

cors = CORS(app, allowed_origins="*",

If you want to use a wildcard it should be given as a string, not a list.

[af1964]

It's what I did.

[miguelgrinberg]

It's not. Your code shows you are using a list.

[af1964]

did this. Same result as before
app = Microdot()
cors = CORS(app, allowed_origins="*",
allow_credentials=True,handle_cors = True)
cors.initialize(app)

[miguelgrinberg]

Are you trying to verify how CORS works using curl? That's not going to work unless you know how to create a curl request that mimics what the browser sends. It's not enough to send an OPTIONS request, there's more to it.

Can you show me a complete minimal example that I can test here to reproduce the problem please?

[af1964]

OTA.zip
ota.zip
The fist file is the OTA server the second one is the ESP32 .py file. Put the .py file in a ESP32. Modify your credential. Connect the ESP32. Lauche OTA on a serveur (I'm using xampp). Choose the ESP32 (list of ESP32 connected) on the interface chose the file to transmit.

[miguelgrinberg]

Remove the cors.initialize(app) line. This is causing the recursion. You have initialized the CORS extension by passing app as an argument in the constructor.

❯ curl -X OPTIONS -H 'Origin: https://google.com' -d'{"file":"x.txt"}' -v http://localhost:5000/download
* Host localhost:5000 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:5000...
* connect to ::1 port 5000 from ::1 port 38622 failed: Connection refused
*   Trying 127.0.0.1:5000...
* Connected to localhost (127.0.0.1) port 5000
> OPTIONS /download HTTP/1.1
> Host: localhost:5000
> User-Agent: curl/8.5.0
> Accept: */*
> Origin: https://google.com     # <-- I'm passing an origin here, like browsers do
> Content-Length: 16
> Content-Type: application/x-www-form-urlencoded
>
* HTTP 1.0, assume close after body
< HTTP/1.0 200 OK
< Allow: POST, OPTIONS
< Access-Control-Allow-Origin: https://google.com    # <-- the origin is accepted in the response
< Vary: Origin
< Access-Control-Allow-Credentials: true
< Content-Length: 0
< Content-Type: application/json; charset=UTF-8
<
* Closing connection

[af1964]

Done. It Works. Thanks a lot.