I want to make a React.js app that can interact with Odoo and its endpoints in a secure way while allowing to have the auth flag set to user and cors enabled.
For this I've set an endpoint like this:
@http.route('/endpoint', type='json', auth="user", cors="*")
def endpoint(self, **params):
This works with no problem when I post with axios from React.js with auth set to none but I want to keep user authentication, and if I do keep it with user="auth" I get the following.
Access to XMLHttpRequest at 'http://localhost:8069/endpoint' from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.
I don't understand, I have the cors flag in the endpoint and I'm sending in the headers the session_id that the authenticate method gives me.
"Content-Type": "application/json",
Accept: "application/json",
"X-Openerp-Session-Id": Cookies.get("session_id"),
I've tried many things but none has yield a good result. Is there no way to tell Odoo through a header that I'm a real user outside a template rendered by its engine? While keeping cors enabled (which apparently I haven't been able to do regardless of what the official documentation tells me) and an auth flag to keep the data secure?