Today I spent some time wrestling with the notorious
same origin policy
in order to get CORS
(cross-origin resource sharing)
working in Chrome for development work I was doing between two applications
running on localhost. Setting the Access-Control-Allow-Origin
header to *
seemed to have no effect, and
this bug report
nearly led me to believe that was due to a bug in Chrome that made CORS with
localhost impossible. It's not. It turned out that I also needed some other
CORs-related headers: Access-Control-Allow-Headers
and
Access-Control-Allow-Methods
.
This (slightly generalized) snippet of Express.js middleware is what ended up working for me:
1 | app.all("/api/*", function(req, res, next) { |
With that, Chrome started making OPTIONS requests when I wanted to POST from
localhost:3001 to localhost:2002. It seems that using contentType:
application/json
for POSTs forces CORS preflighting, which surprised me since
it seems like a common case for APIs, but no matter:
1 | app.all("/api/*", function(req, res, next) { |