The 'Access-Control-Allow-Origin' header contains the invalid value 'null' about cors_plug HOT 14 CLOSED

Had the same issue as @nicooga, removed [origin: "localhost: 4000"] from plug CORSPlug and I was able to get the response back without The 'Access-Control-Allow-Origin' header contains the invalid value 'null'.

from cors_plug.

@nicooga Hard to track down from the information provided. Maybe provide the output of this:

curl -svo /dev/null -XOPTION https://9e68e012.ngrok.io/api/expenditures
curl -svo /dev/null https://9e68e012.ngrok.io/api/expenditures

from cors_plug.

I choosed to just plug CORSPlug without options for now. If I find issues using a named origin instead of a wildcard later I'll reopen the issue. Thanks for the response!

from cors_plug.

I found that the client attached the Origin header with content which is in the config list, or the Access-Control-Allow-Origin will be null, according to this:

from cors_plug.

Sorry for the radio silence, swamped lately... Will check this out shortly. PRs are always welcome tho :)

from cors_plug.

Will take a look and see if I can make any changes. Will let you know if I have any questions

Thanks

from cors_plug.

Not working for me. :(

from cors_plug.

This was happening to me because the requests coming into my server had the origin header with a capital "O", and this is specifically looking for origin (lowercase).

from cors_plug.

Hi, I'm also seeing null as the value. I've set

plug CORSPlug, origin: ["https://example.com", "https://another.com"]
plug MyApp.Router

… but If I do

plug CORSPlug
plug MyApp.Router

the value is * as per the default options.

So something IS working and I assume the error is in my configuration. Any help would be appreciated.

from cors_plug.

@oskarrough Did you check what's the value of the request Origin header? As I mentioned in #18 (comment)

from cors_plug.

@linjunpop ooooh, thank you. Checking the value I discovered a typo in my domain…

from cors_plug.

@mschae IMO this behaviour is confusing, is that expected?

from cors_plug.

@linjunpop I don't understand the behaviour you are describing. Please elaborate following standard issue reporting guidelines: What behaviour do you expect. What behaviour are you seeing instead? Why do you believe this is wrong?

from cors_plug.

Oh, my mistake, https://www.w3.org/TR/cors/#access-control-allow-origin-response-header describe the null is valid.

from cors_plug.