Bearer token auth CORS issue

[michaelbromley]

Describe the bug
When using the "bearer" auth method, the "vendure-auth-token" cannot be read from another origin since it is a non-standard header.

If you want clients to be able to access other headers, you have to use the Access-Control-Expose-Headers header. The value of this header is a comma-delimited list of response headers you want to expose to the client.

As it stands the server would have to be manually configured to allow the vendure token header to be read from another origin:

const config: VendureConfig = {
  // ...
  cors: {
    exposedHeaders: ['vendure-auth-token'],
  }
};

Expected behavior
This should not be something the developer needs to think about. It should be enabled by default if the "bearer" method is being used.

Care needs to be taken to not override any existing CORS options specified in the config.

Environment (please complete the following information):

• @vendure/core version: 0.1.2-beta.11

[phuoymakara]

@michaelbromley I get errors when fetching data on another application and It may the error with cores. So, how can I do it in right way?

[michaelbromley]

@phuoymakara For support requests, please join our Discord community: https://vendure.io/community