CORS stopped working

CORS headers for Hoodie APIs no longer get set, so cross origin requests fail.

Steps to reproduce:

1. git clone https://github.com/hoodiehq/hoodie-app-tracker.git
2. cd hoodie-app-tracker/
3. npm start -- --url="http://localhost:8080"
4. Open http://127.0.0.1:8080/account.html in an incognito / private tab.
5. Try to log in.

A message like this should appear in the console:

XMLHttpRequest cannot load http://localhost:8080/hoodie/account/api/session. Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘http://127.0.0.1:8080’ is therefore not allowed access. The response had HTTP status code 404.

[sdvg]

@gr2m Not really, I spent some time on this but didn’t find out much new. The Hoodie implementation looks got to me (but I didn’t find much documentation on the sandbox feature).

Next steps could be to look for a solution in the hapi code or to build a reduced test case. I can’t tell when I’ll find the time to do so 😕

[gr2m]

Hey @sdvg any update on the issue? @brunopedroso just run into the same thing

For the record: a temporary workaround is to remove sandbox: 'plugin' from https://github.com/hoodiehq/hoodie/blob/master/server/index.js#L55