Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

CORS middleware issue when origin host starts with a digit

See original GitHub issue

We have noticed an issue with the CORS middleware (default CORS.policy implementation) whereby it doesn’t recognise a request as a CORS request if the host in the Origin header starts with a digit. For example, a CORS request with header Origin: https://www.example.com will work correctly, but a CORS request with header Origin: https://2ww.example.com will not.

This is an issue in the 0.23.6 release but it looks like it has already been fixed in the series/0.23 branch (presumably via one of the merges into that branch that have occurred since 0.23.6 was cut). I think the issue is caused by a missing .backtrack in the Rfc3986.ipv4Address parser meaning that in the case where the host starts with a digit, we never actually run the subsequent parser which should match the RegName host. Compare in v0.23.6 vs in series/0.23.

If the above is correct, would it be possible to get a release cut from the current series/0.23 branch so that we can just upgrade to fix the issue? 🙏

Issue Analytics

State:
Created 2 years ago
Comments:6 (3 by maintainers)

Top GitHub Comments

1reaction

talbotjacommented, Dec 9, 2021

Ah yep I can get it now. Apologies, for some reason I couldn’t see it when I checked yesterday morning.

0reactions

rossabakercommented, Dec 9, 2021

The website publishing failed because of that, but I see 0.23.7 jars on Maven Central. The Sonatype publish happens before the website publish in that job. Let me know if you’re still unable to resolve them.

Top Results From Across the Web

3 Ways to Fix the CORS Error — and How the Access-Control ...

Fix one: install the Allow-Control-Allow-Origin plugin. The quickest fix you can make is to install the moesif CORS extension .

Cross-Origin Resource Sharing (CORS) - MDN Web Docs

For example, XMLHttpRequest and the Fetch API follow the same-origin policy. This means that a web application using those APIs can only request ......

CORSMiddleware not work · Issue #1663 · tiangolo/fastapi

Access to fetch at 'http://127.0.0.1:8000/tokenize/' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control- ...

CORS Tutorial: A Guide to Cross-Origin Resource Sharing

When a server has been configured correctly to allow cross-origin resource sharing, some special headers will be included. Their presence can be ...

CORS: Cannot use wildcard in Access-Control-Allow-Origin ...

If you are using CORS middleware and you want to send withCredential boolean true, you can configure CORS like this: var cors =...