apache / apache/couchdb

Cross Origin configuration not working

Open
#2,570 10 comments 2 reactions 0 assignees View on GitHub
api bug security
Dominant language
Erlang
Stars
7k
Forks
1.1k
Avg merge
1d 16h
Merged PRs (30d)
9

Description

[NOTE]: # ( ^^ Provide a general summary of the issue in the title above. ^^ )

## Description

I'm attempting to use CouchDB directly from a browser-based application. I have configured CORs as directed in the documentation, and via the Fauxton Administrative interface, verified it is enabled. However, when I run an XMLHttpRequest in Chrome, it fails with a denial saying that "Http did not return with status code 200".

When running an "OPTIONS" request with curl, it also fails with
```{"error":"method_not_allowed","reason":"Only DELETE,GET,HEAD,POST allowed"}```

## Steps to Reproduce

[NOTE]: # ( Include commands to reproduce, if possible. curl is preferred. )

## Expected Behaviour

After configuring CORs configuration, OPTIONS request respond correctly with appropriate headers.

## Your Environment

* CouchDB version used: 2.3
* Browser name and version: Chrome 80.0.3987.116
* Operating system and version: Fedora 31

## Additional Context

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the OPTIONS request with curl against CouchDB 2.3, then compare the Fauxton CORS configuration with the XMLHttpRequest failure in Chrome. Done means OPTIONS returns status 200 with the appropriate CORS headers and the browser-based request succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
erlang, javascript
Domain
api, backend, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.