Auto-Inject "Access-Control-Allow-Credentials" for Private Port Responses

[AaronBeaudoin]

Problem

To accept CORS requests on services running behind private ports, developers currently have to configure the service to accept credentials, even though they aren't actually using them. This is because Gitpod requires credentials to be sent, but when the response comes back from the service it will be rejected if it doesn't have the Access-Control-Allow-Credentials header.

Desired Behavior

For responses coming from private ports, Gitpod should automatically add the Access-Control-Allow-Credentials header, because it is Gitpod that is actually using the credentials, not the service behind the port. This makes private port usage more transparent. (A bonus would be to actually document what Gitpod is requiring in the requests to private ports, so people don't have to dig down the forums rabbit hole like I did in order to find out. EDIT: I just made gitpod-io/website#2164 for this.)

Alternatives

Force the developer (like how it works currently) to configure all services that need to support CORS through private ports to accept credentials and add the Access-Control-Allow-Credentials header on responses, even though they aren't actually using doing anything with the incoming credentials.

Context

https://community.gitpod.io/t/why-do-i-get-a-cors-error-but-only-if-my-port-is-private/5547

Thanks to geropl for explaining this undocumented behavior and suggesting this solution.

[geropl]

This is sth I'd like to discuss with workspace: As explained here, we private ports in particular do behave special when it comes to credentials (required for us to authorize) and CORS (sth we could help out with, see @AaronBeaudoin explanation).

It's a tradeoff between "educating users" (adding doc) and "introducing magic", and I must admit I'm not 100% sure which to prefer. 🙂

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[loujaybee]

Potentially we could introduce this as an explicit option on the ports (either opt-in, or opt-out), whichever is the most sane default: https://www.gitpod.io/docs/references/gitpod-yml

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[nVitius]

@loujaybee @geropl
Can we re-open this issue?

Right now I'm having to conditionally enable Access-Control-Allow-Credentials if I detect that my app is running on gitpod. It would be nice if the proxy handled that for us.

[Methodician]

@nVitius can you show an example of this approach? It seems that workarounds are all we have still.