fix(cors): allow OPTIONS request to KDF server

[shamardy]

@KomodoPlatform/qa To Test:
Already tested by @CharlVS

No docs needed for this PR.

[laruh]

LGTM!

[mariocynicys]

the clone here we don't need i guess.

[shamardy]

fixed here 3dc9715

[mariocynicys]

maybe we want to abandon rpccors now?

[shamardy]

I realize now that this port should be the frontend port used in development. I can use the client port here instead, but this opens it up for any port the request comes from, e.g., a script running locally on any port in the browser can access the RPC service. I will revert to port 3000 as it's commonly used for frontend development.

[shamardy]

Fixed here 6f144e9

[laruh]

Everything is looks good to me, only small note

[mariocynicys]

LGTM :)

I am wondering tho how did cors work before since the specs mention that the browser sends an OPTIONS request first and we didn't cover that.

[CharlVS]

I am wondering tho how did cors work before since the specs mention that the browser sends an OPTIONS request first and we didn't cover that.

@mariocynicys I'm assuming this wasn't picked up until now because there hasn't been an attempt to implement remote RPC access from the browser until now and since running WASM KDF in the browser doesn't use HTTP.

This is being worked on now as part of a Flutter SDK package for KDF repository here. The demo site is available here: https://komodo-playground.web.app/

[CharlVS]

@shamardy I'm having the same CORS errors for 500 responses because the Access-Control-Allow-Origin header isn't included in the response. Because of this, the browser does not allow access to the actual response and throws a generic XML exception.

Here's an example of the request and response using curl. Note the absence of the cors headers in the response.

curl -v --url "127.0.0.1:7783" --data '{
  "method": "&version"
}'
*   Trying 127.0.0.1:7783...
* Connected to 127.0.0.1 (127.0.0.1) port 7783
> POST / HTTP/1.1
> Host: 127.0.0.1:7783
> User-Agent: curl/8.6.0
> Accept: */*
> Content-Length: 26
> Content-Type: application/x-www-form-urlencoded
> 
< HTTP/1.1 500 Internal Server Error
< content-type: application/json
< content-length: 25
< date: Tue, 20 Aug 2024 13:57:08 GMT
< 
* Connection #0 to host 127.0.0.1 left intact
{"error":"Invalid input"}

[borngraced]

Great work.. just couple notes.

[borngraced]

@shamardy I'm having the same CORS errors for 500 responses because the Access-Control-Allow-Origin header isn't included in the response. Because of this, the browser does not allow access to the actual response and throws a generic XML exception.

Here's an example of the request and response using curl. Note the absence of the cors headers in the response.

curl -v --url "127.0.0.1:7783" --data '{
  "method": "&version"
}'
*   Trying 127.0.0.1:7783...
* Connected to 127.0.0.1 (127.0.0.1) port 7783
> POST / HTTP/1.1
> Host: 127.0.0.1:7783
> User-Agent: curl/8.6.0
> Accept: */*
> Content-Length: 26
> Content-Type: application/x-www-form-urlencoded
> 
< HTTP/1.1 500 Internal Server Error
< content-type: application/json
< content-length: 25
< date: Tue, 20 Aug 2024 13:57:08 GMT
< 
* Connection #0 to host 127.0.0.1 left intact
{"error":"Invalid input"}

it seems like the build that you used to run this test doesn't reflect with the changes in the PR yet..

[shamardy]

I'm having the same CORS errors for 500 responses because the Access-Control-Allow-Origin header isn't included in the response. Because of this, the browser does not allow access to the actual response and throws a generic XML exception.

@CharlVS are you using latest build/commit from this PR? If you are then the error has to be related to something in your mm2 config as far as I can see. Only errors I don't return cors for is the ones before cors is set.

    let ctx = try_sf!(MmArc::from_ffi_handle(ctx_h));
    // https://github.com/artemii235/SuperNET/issues/219
    let rpc_cors = match ctx.conf["rpccors"].as_str() {
        Some(s) => try_sf!(HeaderValue::from_str(s)),
        None => {
            if ctx.is_https() {
                HeaderValue::from_static("https://localhost:3000")
            } else {
                HeaderValue::from_static("http://localhost:3000")
            }
        },
    };

So either rpccors setting has a problem or mm2/kdf was stopped/ctx dropped which shouldn't happen. How is rpccors set? this try_sf!(HeaderValue::from_str(s)) doesn't return a cors header if rpccors is not a valid header value when starting mm2.

[CharlVS]

Thanks, @shamardy. Yeah, it looks like I was not running the latest version, even though I double-checked that I had the latest zip downloaded. I suspect I may have unzipped the previous build after I downloaded the new zip. I'm testing it out now.

I will test again now and let you know.

[CharlVS]

Working as expected. Thanks for swiftly resolving this :)