Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

getCurrentUser query is ignoring CORS configuration

See original GitHub issue

After setting a cors configuration inside my graphql.js, it seems to work for every request except the built-in getCurrentUser query.

export const handler = createGraphQLHandler({
  schema: makeMergedSchema({
    schemas,
    services: makeServices({ services }),
  }),
  cors: {
    origin: '*',
    credentials: true,
  },
  db,
  getCurrentUser,
})

Request headers:

Provisional headers are shown
auth-provider: custom
authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjM5NjM2Y2UzLTE1NTUtNDkwYi1hMDQ2LWE3YmFjYzc3ZmI3MyIsIm5hbWUiOiJKYXkiLCJlbWFpbCI6ImpheUBmaXNoZWQuaW8iLCJyb2xlIjoiQ1VTVE9NRVIiLCJ2ZXJpZmllZCI6ZmFsc2UsImNvbXBhbnlJZCI6IjNhYzlkMGQzLTA5MjYtNDc2NC1iYjkxLTAzNjc2ODBkMjhlYiIsImlhdCI6MTYwMjE0MzA0MH0.qVvxWB4VJwx34fsIX0gm4i_--a-SPXtTpA1TXBPU_1g
content-type: application/json
Referer: https://example.com/log-in
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Edg/85.0.564.70

Issue Analytics

State:
Created 3 years ago
Reactions:1
Comments:12 (6 by maintainers)

Top GitHub Comments

3reactions

dac09commented, Oct 8, 2020

Hey! So this isn’t an issue I personally face, since we use a custom auth client (at the moment).

However, it looks like the main reason we have this issue is this line here: https://github.com/redwoodjs/redwood/blob/820982917c9bb45b72b2438d4be41c3de8be588a/packages/auth/src/AuthProvider.tsx#L116

Can I ask a few more questions to clarify @jmcmullen? a) What is the endpoint you’re using for your graphql API? b) Where are you deploying your code? c) Could you please try setting the apiProxyPath to the URL in redwood.toml I’m assuming from the forum post that your API is probably deployed elsewhere.

My thoughts right now:

Option 1: Allow overriding of specific functions on the AuthProvider
Option 2: Provide another environment variable in redwood.toml that RW will use if the variable is defined e.g.

[web]
  graphQLEndpoint = "https://api.mycustomlocation.com/api/graphql"

1reaction

Irev-Devcommented, Dec 12, 2021

@jmcmullen How are you deploying?

If you’re deploying such that the API is on a different domain than origin: ‘*’, won’t work as the wild card is not allowed for requests with credentials. Has nothing to do with RW, just a cors thing.

https://www.moesif.com/blog/technical/cors/Authoritative-Guide-to-CORS-Cross-Origin-Resource-Sharing-for-REST-APIs/#7--using-wildcard-when-access-control-allow-credentials-is-set-to-true