CORS changed in 4.22.0 & my cors settings no longer work but origin ['*'] does

commentsBot · April 3, 2024, 8:19pm

found some old issues related to this

github.com/strapi/strapi

Updating koa/cors to 3.4.2 in order to fix cors filter origin problem #14357

strapi:main ← CleberRossi:bugfix/fix-cors-default-headers-14357

opened 03:25AM - 06 Oct 22 UTC

CleberRossi

+9 -2

Updating koa/cors to 3.4.2 in order to fix cors filter origin problem #14357 … There was a bug that is fixed on koa/cors 3.4.2 version. Fixes #14357  ### What does it do? In order to fix #14357 I had to fix another bug on koa/cors, as my PR was merged -> https://github.com/koajs/cors/pull/87 I'm creating this PR in order to update the lib ### Why is it needed? Koa/cors was not calling origin middleware when the origin header was not present. Hence, even when you set credentials as false, the middleware was not called and people could not get Access-Control-Allow-Origin as '*'. ### How to test it? Set credentials as false on config/middlewares.js, call any API in order to retrive Access-Control-Allow-Origin as '*' as DEFAULT. ``` { name: 'strapi::cors', config: { credentials: false, }, }, ``` ### Related issue(s)/PR(s) Fix #14357 Please, could you add https://hacktoberfest.com/ label?

github.com/strapi/strapi

In Strapi 4.4.4 CORS strategy doesn't work anymore and throws 500 error

opened 02:40PM - 19 Oct 22 UTC

closed 04:37PM - 19 Oct 22 UTC

kwiat1990

issue: bug severity: high status: confirmed source: core:strapi

# Setup - Node.js version: 16.14.2 - NPM version: 8.13.2 - Strapi version: …4.4.4 - Database: postgres - Operating system: MacOS Monterey 12.6 ### Describe the bug After recently update from `4.4.3` to `4.4.4` responses with the following error while visiting `localhost:1337` or any other related URL: ```json { "data": null, "error": { "status": 500, "name": "InternalServerError", "message": "undefined is not a valid origin" } } ``` I have a custom CORS policy in `middleware.js` (see "step to reproduce" for the code), which did worked with previous versions. After update to `4.4.4` it seems to be broken. Using standard CORS config as `'strapi::cors'` fix the issue. ### Steps to reproduce the behavior 1. Update Strapi to 4.4.4 2. Make sure to have custom CORS policy in `middleware.js`, e.g.: ```js { name: "strapi::cors", config: { enabled: true, headers: "*", origin: env.array("ALLOWED_ORIGINS_URL"), // for example: http://localhost:3000,http://localhost:1337 }, }, ``` ### Expected behavior Strapi works normally without any errors. Admin panel can be visited.