ApolloServer.applyMiddleware doesn't support OPTIONS requests

[nounder]

As far as I know, it only applies to Koa integration. Could be for other integrations, too.

ApolloServer.applyMiddleware only add middleware to support GET and POST requests. It should also support OPTIONS. Otherwise it will break setup when client and server are on different hosts.

Why does it matter? Given you want to access GraphQL server (at graphql.local) on web client (at frontend.local) browser will send OPTIONS request before any user request to make sure graphql.local accepts requests made from frontend.local (via Access-Control-Allow-Origin header).

[abernix]

I would happily review a PR which adds this! There are implementations of this in other integrations (it is missing from -express, -koa, and probably others) which can be used as prior art.

For example, the Azure Functions integration :

apollo-server/packages/apollo-server-azure-functions/src/ApolloServer.ts

Lines 116 to 124 in 6c87cbc

	if (req.method === 'OPTIONS') {
	context.done(null, {
	body: '',
	status: 204,
	headers: corsHeaders,
	});
	return;
	}

...and in the Google Cloud Functions implementation as well:

apollo-server/packages/apollo-server-cloud-functions/src/ApolloServer.ts

Lines 118 to 122 in b61dee3

	if (req.method === 'OPTIONS') {
	res.status(204).send('');
	return;
	}

[cheapsteak]

It looks like OPTIONS is working for -express (I just checked against fullstack-tutorial)

I would guess the cors middleware is handling OPTIONS automatically

apollo-server/packages/apollo-server-express/src/ApolloServer.ts

Lines 148 to 152 in 2f77362

	if (cors === true) {
	app.use(path, corsMiddleware());
	} else if (cors !== false) {
	app.use(path, corsMiddleware(cors));
	}

It looks like there are similar lines in -koa

apollo-server/packages/apollo-server-koa/src/ApolloServer.ts

Lines 149 to 153 in 2f77362

	if (cors === true) {
	app.use(middlewareFromPath(path, corsMiddleware()));
	} else if (cors !== false) {
	app.use(middlewareFromPath(path, corsMiddleware(cors)));
	}

I wonder if '@koa/cors' should handle this?

[abernix]

Ah, that makes sense. I guess some integrations handle it at another level. Thanks for pointing this out, @cheapsteak!