How to allow CORS?

[setroc]

I started doing the rest server tutorial but my front end requests a different port than the server, so the browser sends me a CORS error, I haven't found how to enable it in the documentation, could you help me? thanks for your help

[scaprile]

Can you please post exactly what you are doing and exactly what the error is ? (minimum possible showing the issue)
Please follow this guide (or an equivalent for your browser) https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors

[setroc]

This is the error I get when executing my "callF1" function, the front is running on port 5173, while the REST service is running on port 8000, it's really not a problem for me because with a chrome extension I was able to solve it , but I would like to know how to configure that header in mongoose, could you help me?
Error image

callF1 function

[d4rkmen]

Hi, cross origin requests requires from RESPONSE some additional headers, allowing the origin, method etc.

Example:
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: *

More details can find on the internet

[WelBert-dev]

I having the same problem, even sending the appropriate headers in the API response, the same problem continues ..
the only thing that solves it is either adding the browser extension that ignores the cors or sending the header "mode: no-cors" together with the frontend request, but this option blocks the response object, so even if the API response is 200 ok the response object is blocked and when accessing response.status the return is 0 (There are differences in the API response when analyzed by the browser's debbuger using the inspect developer tool)

[scaprile]

@WelBert-dev Please don't necropost, this Q is 2 releases old. If you have an issue then open an issue, fill the template and provide all relevant information. Be clear on what you do and what you see, attach network capture files of your issue

[WelBert-dev]

[PROBLEM RESOLVED] To solve this problem, the server must implement the logic of the pre-flight OPTIONS request, which is the first request (even if not explicitly configured) that occurs in the first moment, this request is responsible for indicating which resources the server releases to the client. then just check what type of request the client is and if it is OPTIONS it returns 204 containing the CORS headers with the resources released by the server.

[ SCENARIO] :
Trying to request to the mongoose server from sources other than it (ports/ips) without treatments on the correctly configured pre-flight OPTIONS request.

[ BEFORE ]:

static void fn(struct mg_connection *c, int ev, void *ev_data, void *fn_data) {
  if (ev == MG_EV_HTTP_MSG) {
    struct mg_http_message *hm = (struct mg_http_message *) ev_data;

    if (mg_http_match_uri(hm, "/api/post")) {

    TODO ...
      
    } else {
      struct mg_http_serve_opts opts = {.root_dir = s_root_dir};
      mg_http_serve_dir(c, ev_data, &opts);
    }
  }
  (void) fn_data;
}

[ SOLUCTION ]:

static void fn(struct mg_connection *c, int ev, void *ev_data, void *fn_data) {
  if (ev == MG_EV_HTTP_MSG) {
    struct mg_http_message *hm = (struct mg_http_message *) ev_data;
    if (mg_vcmp(&hm->method, "OPTIONS") == 0) {
          printf("Recebida requisição OPTIONS pré-voo\n");
    
          // Retorna os CORS Liberados (TODOS);
          mg_http_reply(c, 204, "Content-Type: application/json\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: *\r\n\r\n",
                        "No Content");
    } 
    if (mg_http_match_uri(hm, "/api/post")) {

    TODO ...
      
    } else {
      struct mg_http_serve_opts opts = {.root_dir = s_root_dir};
      mg_http_serve_dir(c, ev_data, &opts);
    }
  }
  (void) fn_data;
}

[scaprile]

Please follow your browser and d4rkmen advice HERE and his link that explains how to do it.
These are the docs for the reply function
https://mongoose.ws/documentation/#mg_http_reply
I bet the graphics there are clear enough

[setroc]

Thanks a lot!