firebase / firebase/firebase-tools

HTTP function emulator forcibly handles all OPTIONS requests, and seems to assume they are all CORS preflight requests

Open
#6,640 2 comments 0 reactions 1 assignee Claimed by @taeold View on GitHub
emulators: functions type: bug
Dominant language
TypeScript
Stars
4.5k
Forks
1.3k
Avg merge
1d 12h
Merged PRs (30d)
84

Description

### [REQUIRED] Environment info

**firebase-tools:** 13.0.2

**Platform:** macOS

### [REQUIRED] Test case

Any OPTIONS request to an HTTP function.

### [REQUIRED] Steps to reproduce

1. Author any trivial HTTP function that logs anything upon invocation
2. Run the emulator with it
3. Send it an OPTIONS request, for example:

```
curl \
-H "Origin: https://example.com" \
-H "Access-Control-Request-Method: GET" \
-H "Access-Control-Request-Headers: X-Requested-With" \
-X OPTIONS \
--verbose \
[function url]
```

### [REQUIRED] Expected behavior

I expect to see a log message for the invocation of the OPTIONS request.

### [REQUIRED] Actual behavior

The emulator internally handles the OPTIONS request and doesn't invoke the function code. On top of that, it seems to assume that the OPTIONS request is a CORS preflight request. It always sends back a response that looks like this:

```
< HTTP/1.1 204 No Content
< x-powered-by: Express
< access-control-allow-origin: https://example.com
< vary: Origin, Access-Control-Request-Headers
< access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
< access-control-allow-headers: X-Requested-With
< content-length: 0
< date: Sat, 23 Dec 2023 21:20:36 GMT
< connection: close
```

Note also (as a second, separate problem here) that the access-control-allow-origin header is **always** exactly what was provided in the request Origin header, regardless of any actual cors configuration that would send otherwise. Also the access-control-allow-methods is always the same and never what the function wants to send (because it can't actually handle the cors response).

This behavior is problematic because I can't test my own OPTIONS handling, or any 3rd party CORS handling libraries. I have to deploy the code to see a proper OPTIONS invocation with the response that I want.

I understand this behavior makes it easy to get started working with HTTP and callable functions, but it's not accurate emulation, and leads to potential disappointment or frustration upon deployment.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.