CORS not working with 1.2

[dr3mro]

I have built a CROW API server using version 1.1 but I get Error 204
here is my code

#pragma once

#include <crow.h>
#include <crow/middlewares/cors.h>

class CORSHandler {
public:
    template <typename App>
    CORSHandler(App app)
    {
        auto& cors = app->template get_middleware<crow::CORSHandler>();

        // Global CORS settings
        cors.global()
            .origin("http://localhost:3000")
            .methods("GET"_method, "OPTIONS"_method)
            .headers("Content-Type", "Accept-Encoding", "Origin")
            .max_age(3600)
            .allow_credentials();

        // CORS settings for /v1/hello prefix
        cors.prefix("/v1/hello")
            .origin("http://localhost:3000")
            .methods("GET"_method, "OPTIONS"_method)
            .headers("Content-Type", "Accept-Encoding", "Origin")
            .max_age(7200)
            .allow_credentials();
    }

    ~CORSHandler() = default;
};

int Server::run()
{
    print_banner();
    CORSHandler cors(app);

    try {
        app->loglevel(crow::LogLevel::INFO)
            .use_compression(crow::compression::algorithm::GZIP)
            .port(PORT)
            .multithreaded()
            .concurrency(srv_threads)
            .bindaddr("0.0.0.0")
            .server_name("Valhalla")
            .run();

    } catch (const std::exception& e) {
        std::cerr << "Exception caught in main: " << e.what() << std::endl;
        return 1; // Exit with error code
    }

    return 0;
}

 curl http://localhost:8080/v1/patient  -X OPTIONS -i
HTTP/1.1 204 No Content
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type, Accept-Encoding, Origin, Authorization
Access-Control-Allow-Methods: GET, POST, DELETE, PATCH, SEARCH, OPTIONS

 curl http://localhost:8080/v1/hello  -X GET -i
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type, Accept-Encoding, Origin
Access-Control-Allow-Origin: http://localhost:3000
Access-Control-Max-Age: 7200
Access-Control-Allow-Methods: GET, OPTIONS
Content-Length: 36
Server: Valhalla
Date: Tue, 23 Jul 2024 23:44:52 GMT
Connection: Keep-Alive

{
"Message" : "Welcome to ASGARD."
}%

what am I doing wrong?

[bugdea1er]

CORS was broken in Crow 1.1, hopefully it will be fixed in #799

[paulharris]

Thanks for the test case, I adapted it for my investigation here:
#799 (comment)

As I understand it, CORS isn't broken, it is just triggering a bug returning a response without reading the full request - the transmission is cancelled before it can be completely sent (a kind of race condition).
see my link for an alternative hack, see if that works for you.
I imagine my hack will hurt performance, but it will be interesting to know if it at least works.