Restore CORS for 401s #4894
Merged
Restore CORS for 401s #4894
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
kieckhafer
approved these changes
Jan 7, 2019
There was a problem hiding this comment.
👍 Good, along with the client updates at reactioncommerce/example-storefront#471
kieckhafer
requested changes
Jan 7, 2019
|
@kieckhafer Yes I've noticed that failure happening more often, but it's not related. I'll dig in to see if we can remove or disable that test, but it doesn't need to block this PR. |
kieckhafer
approved these changes
Jan 7, 2019
|
Failing test is a timeout error that has been happening intermittently on various PR's, it's not isolated here, therefore it shouldn't block this PR from being merged. |
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Impact: minor
Type: bugfix
Issue
When I updated to Apollo Server 2.0, I switched to using their built-in CORS middleware. Unfortunately, I've now discovered that this only adds the CORS header for requests that make it past our auth middleware. This could be OK, but it turns out that Apollo Client behavior changes when the 401 response doesn't allow CORS, and this prevents the starterkit auto-token-refresh logic from working properly.
Solution
Add back explicit CORS middleware, prior to the auth middleware.
Breaking changes
None
Testing
Try a GraphQL request with an expired or invalid token, and examine the headers of the 401 response. Verify that you see
Access-Control-Allow-Origin: *header.