Firefox CORS failure with express node server

user_540890 0
Viewed 1576

I'm using Express.js with the CORS middleware. I'm getting very strange behavior on Firefox v73.0.1 (64-bit)

Clean firefox profile... so nothing is cached.

  1. I try a direct request to http://localhost/search?q=AMZN, I get results as expected.
  2. I open my webapp which is running on localhost:3000. All of these requests are not using TLS/SSL.
  3. I get "Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost/search?q=AMZN. (Reason: CORS request did not succeed)." when it tries to reach out to the API server backend.
  4. I refresh the other tab where I was accessing localhost directly (same request which succeeded before), and I get a "connection reset".

Chrome does not do this...

I have been looking at wireshark and Firefox simply sends a GET request (several of them? Why?? I'm only making one), sends the headers and such, then it is followed by connection reset.

Sounds like node is doing something wrong? Or I dunno.

const express = require('express');
const fetch = require('node-fetch');
const util = require('util');
const app = express();
const port = 80;

var cors = require('cors')

var copts = {
  origin: function (origin, callback) {
      console.log('yeah');
    // allow all
    callback(null, true);
  }
}

const SEARCH_URL = 'https://api.stocktwits.com/api/2/streams/symbol/%s.json';

app.get('/search', cors(copts), (req, res) => {

The "yeah" part never is hit at all.

Very simple clientside code.

return fetch(BACKEND_URL + uri).then(response => {

Tried removing CORS middleware and added these headers, based on examining github's cross-browser request-response in chrome

    res.header('Access-Control-Allow-Methods', 'GET');
    res.header('Access-Control-Max-Age', '3600');
    res.header('Vary', 'Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding');
    res.header('Access-Control-Allow-Origin', '*');

I didn't really have the options handler captured so maybe this didnt matter. I found those headers in the GET response.

express node.js cors firefox
4 Answers

It might be possible that the node server get crashed on an invalid reqeust and hence you are getting the reset error.

With cors package:

You need to add optionsSuccessStatus property in the cors options for some legacy browsers. And OPTIONS handler To enable pre-flightin requests.

const express = require('express');
const fetch = require('node-fetch');
const util = require('util');
const app = express();
const port = 80;
var cors = require('cors')
var copts = {
    origin: function (origin, callback) {
        console.log('yeah');
        callback(null, true);
    },
    optionsSuccessStatus: 200
}
app.options("*", cors(copts));
const SEARCH_URL = 'https://api.stocktwits.com/api/2/streams/symbol/%s.json';
app.get('/search', cors(copts), (req, res) => { });

With headers.: You are missing Access-Control-Allow-Headers in the response headers, you need to add the Access-Control-Allow-Headers header in the response header to allow the Access-Control-Allow-Origin header.

Try this.

const express = require('express');
const fetch = require('node-fetch');
const util = require('util');
const app = express();
const port = 80;
var cors = require('cors')
var copts = {
    origin: function (origin, callback) {
        console.log('yeah');
        // allow all
        callback(null, true);
    }
}
const SEARCH_URL = 'https://api.stocktwits.com/api/2/streams/symbol/%s.json';
app.get('/search', (req, res) => { 
    res.header('Access-Control-Allow-Methods', 'GET, OPTIONS');
    res.header('Access-Control-Allow-Headers', 'Origin');
    res.header('Access-Control-Allow-Origin', '*');
    res.status(200).send("Ok")
});
user_41489020

in my case, FireFox removes the request header from ajax to a http url, but works fine with https

user_72410220

Have you updated your front end package.json file with the following?

"proxy": "http://localhost:[your port here]/",
user_113608490

try assigning CORS to the express server like so: 

const cors = require('cors');
app.use(cors());
user_84908080
Related