Configuring access-control-allow-origin for development environment purposes
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 2.1k
- Forks
- 306
- PR merge metrics
- No merged PRs in 30d
Description
Imagine a situation, where you are running the service on one port and the frontend dev server on another. It's impossible to use sockjs connections, because it will end up with CORS error (origin differs from the backend server url).
How about enable configuring the default response header for Access-Control-Allow-Origin in middleware.js#L123? If you are worried about the potential of unintended security flaws then add an explicit check to not allow overriding it in production environment.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in lib/middleware.js at the referenced line where the default response header is set. Trace how middleware options and the runtime environment are configured, then determine how development requests from another origin should be handled without weakening production behavior. Verify the result with a SockJS connection from a frontend running on a separate port.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- api, backend, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100