Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Error are not reported using CORS middleware

See original GitHub issue

Checklist

The bug is reproducible against the latest release and/or master.
There are no similar issues or pull requests to fix it yet.

Describe the bug

When using CORS middleware, if calling endpoint lead to any unexpected error, the response sent would not hold proper headers leading to the classic TypeError: Origin XXX is not allowed by Access-Control-Allow-Origin. error message from browser.

To reproduce

from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware

api = FastAPI()
api.add_middleware(
    CORSMiddleware,
    allow_origins=['*'],
    allow_credentials=True,
    allow_methods=['*'],
    allow_headers=['*'])


@api.get('/')
def index():
    return """
    <html>
        <body>
              <div id="container"></div>
             <script>
                fetch('/error').catch(function(reason) { document.getElementById('container').innerHTML = reason }); 
            </script>
        </body>
    </html>
    """


@api.get('/error')
def errorcase():
    raise ValueError

Expected behavior

This is misleading as we expect to received a proper HTTP 500 Internal Server Error response at least.

Actual behavior

The returned response does not hold proper CORS Header leading to wrong response in browser.

Environment

Python version: 3.7 (latest)
Starlette version: latest

Issue Analytics

State:
Created 3 years ago
Reactions:3
Comments:9 (4 by maintainers)

Top GitHub Comments

8reactions

leandrorebelocommented, Mar 29, 2021

I have the same issue here. We are using the FastAPI (0.63.0) and Starlette (0.13.6).

So, I was debugging the request I saw that the CORSMiddleware doesn’t call the method send when the Exception is not an HTTPException (StarletteHTTPException).

In this way the CORSMiddleware works.

    def get_test() -> str:
        raise HTTPException(
            status_code=HTTP_500_INTERNAL_SERVER_ERROR,
            detail="Error with HTTPException"
        )

In this way, the CORSMiddleware fails.

    def get_test() -> str:
        raise Exception

1reaction

jcwilsoncommented, Jul 21, 2021

After going through that exercise I think the more elegant option may be to adopt your workaround. More generally - allow developers to easily add middlewares “outside” of the ServerErrorMiddleware.