How to solve CORS restriction?

[gorillatapstudio]

I followed all the guidelines and spent a lot of time debugging but I still received the CORS error when tried to use parse log in / sign up, although other features work fine. I am using B4a 3.10 as parse server, tried both 1.7, 1.8, and 2.0 flutter Parse SDK. Example at https://artisse.us
@phillwiggins do you happen to have a working sample at b4a so that i can start from there? thanks!

Error: Access to XMLHttpRequest at 'http://dogorcat.back4app.io/login?username=g%40gmail.com&password=g' from origin 'http://localhost:49255' has been blocked by CORS policy: Request header field x-parse-installation-id is not allowed by Access-Control-Allow-Headers in preflight response.

In b4a parse server option I have added: { "allowHeaders": [ "X-Parse-Installation-Id" ] }
.

My code to init parse is:
final coreStore = await CoreStoreSharedPrefsImp.getInstance(); await Parse().initialize( _resources.parseApplicationId, " _resources.parseServerUrl, //tried both 'https://parseapi.back4app.com/' or 'https://artisse.back4app.io' clientKey: _resources.parseClientKey, autoSendSessionId: true, debug: false, coreStore: coreStore, appName: kIsWeb ? _resources.appDisplayName : null, appVersion: kIsWeb ? "Version 1" : null, appPackageName: kIsWeb ? "dog" : null, // );

[fischerscode]

Normally, http headers are not case sensitive (I think), but for my self hosted (kubernetes) parse server, I am pretty sure, I had to specify X-Parse-Intallation-Id as well as x-parse-installation-id as allowed headers.

[gorillatapstudio]

Thanks @fischerscode ! i just tried your suggestion but it still returned the same error.
i added the following and I also tried only adding the lower cased string but neither works.
{ "allowHeaders": [ "X-Parse-Installation-Id", "x-parse-installation-id" ] }

[fischerscode]

@gorillatapstudio
But now there is a different error in the browser console, right?

[gorillatapstudio]

yes, the error is little bit different. The second line (FetchEvent Type Error) is new.

js_primitives.dart:47
Access to fetch at 'https://parseapi.back4app.com/login?username=a&password=a' from origin 'https://artisse.us' has been blocked by CORS policy: Request header field x-parse-installation-id is not allowed by Access-Control-Allow-Headers in preflight response.
The FetchEvent for "https://parseapi.back4app.com/login?username=a&password=a" resulted in a network error response: the promise was rejected.
flutter_service_worker.js?v=1408041561:1 Uncaught (in promise) TypeError: Failed to fetch
parseapi.back4app.com/login?username=a&password=a:1 Failed to load resource: net::ERR_FAILED

[fischerscode]

Did you remove x-parse-installation-id again?
Postman:
Access-Control-Allow-Headers: DNT, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, X-Application-ID, X-Access-Token, X-Parse-Master-Key, X-Parse-REST-API-Key, X-Parse-Javascript-Key, X-Parse-Application-Id, X-Parse-Client-Version, X-Parse-Session-Token, X-Requested-With, X-Parse-Revocable-Session, X-CSRF-Token, X-Apollo-Tracing, X-Parse-Client-Key

[gorillatapstudio]

No, i didn't. the config is still as follows but whatever I set up there seems no effect. I tried several apps at b4a i have but it does not work.

{
"allowHeaders": [
"X-Parse-Installation-Id",
"x-parse-installation-id"
]
}

[fischerscode]

I had to specify X-Parse-Intallation-Id as well as x-parse-installation-id as allowed headers

I have figured that part out... The typo was also in my server config.
So you should be fine to specify only the version with the upper-cases.

[fischerscode]

So your setting is definitely not used by the server.
I've just wondered, if X-Parse-Installation-Id is even needed on web, as there is no real installation on web.
And I think X-Parse-Installation-Id is mainly used for push notifications.

So for now, you should be fine using this branch.

  parse_server_sdk_flutter:
    git:
      url: git://github.com/fischerscode/Parse-SDK-Flutter.git
      ref: issue-490
      path: packages/flutter

[gorillatapstudio]

Thanks for the fix! however it still does not work. The error is similar to before. I believe the installation-id is used when log in / sign up / and facebook log in happens.

So it seems the main reason might be the option is not actually applied to the b4a parse server.

:63523/#/loginPage:1 Access to XMLHttpRequest at 'https://parseapi.back4app.com/login?username=a&password=a' from origin 'http://localhost:63523' has been blocked by CORS policy: Request header field x-parse-installation-id is not allowed by Access-Control-Allow-Headers in preflight response.
parseapi.back4app.com/login?username=a&password=a:1 Failed to load resource: net::ERR_FAILED

[fischerscode]

@gorillatapstudio
I forgot to commit the pubspec.yaml.
As a result, the fix was not even applied.
Please give it a try again.

[gorillatapstudio]

@fischerscode so sorry but it still does not work showing the same error.

[fischerscode]

@gorillatapstudio
Did you run pub get?
At here the patch doesn't seem to be active, as X-Parse-Installation-Id is still send.

[gorillatapstudio]

@fischerscode thank you so much! i actually didn't run pub get! totally my fault. it's working now! thanks a million!

[gorillatapstudio]

@fischerscode is it possible to apply this fix to a release based on non-DIO version? Now I am having a hard choice between performance and login feature.

[fischerscode]

@gorillatapstudio
I've pushed fischerscode@d845aff.
This commit allows you, to prevent sending the installation-id by setting doNotSendInstallationID=true.
Could you please test, if this commit works for you? If it does, I will create a PR.

[gorillatapstudio]

@fischerscode thanks for the fix. I set doNotSendInstallationID = true to login, signup and loginwith("facebook", ...) and all three functions worked!

[nstrelow]

Welllll
Hello, it's me. I switched to back4app now. And I have the same problem. I hate my life. I wanted to pack and go on a holiday. Now it's 23h and I have a broken system.

And it was supposed to be published by end of this month. I hate it.

@fischerscode Thanks so much will use your branch!

[fischerscode]

@nstrelow
Wow, that sounds bad. :-O

---

I've created a PR to development with this change. (#494)
Has anyone contacted back4app about the ability to add a allowed header?

[RodrigoSMarques]

We are closing issues that have been open for a long time without activity.
This will make it easier to organize things from now on.
If the problem persists, please open a new issue.
Thanks.