faustinoaq changed the topic of #amber to: Welcome to Amber Framework community! | https://amberframework.org | Developer happiness, productivity and bare metal performance | GH: https://github.com/amberframework | Docs: https://docs.amberframework.org | Gitter: https://gitter.im/amberframework/amber | IRC Logger: https://irclog.whitequark.org/amber | Amber::Server.start
<FromGitter> <samholst> Thank you Dru! WIth `axios` I ended up using the `X-Origin`, works now.
<FromGitter> <drujensen> Np. Glad it’s working. Seems like a common problem people run into. We might want to look at that spec closer.
alexherbo2 has joined #amber
alexherbo2_ has joined #amber
alexherbo2_ has quit [Ping timeout: 256 seconds]
alexherbo2 has quit [Ping timeout: 256 seconds]
_whitelogger has joined #amber
<FromGitter> <Blacksmoke16> a request that doesnt have an `Origin` header is not a CORS request
<FromGitter> <Blacksmoke16> and does not need to be validated
<FromGitter> <drujensen> Is it automatically set by the browser?
<FromGitter> <drujensen> for Post requests?
<FromGitter> <Blacksmoke16> it should be yes
<FromGitter> <drujensen> @samholst do you mind opening a ticket about this issue? If the origin header doesn’t exist, the CORS pipe should ignore it and not validate against the allowed list.
<FromGitter> <drujensen> This would explain why other frameworks do not require it. ;-)
<FromGitter> <eliasjpr> The browser should be setting the origin header it looks like is not doing that for case above which is why is requiring manually setting it up.
<FromGitter> <eliasjpr> As per the 403 forbidden it is true that is should not be validated when the origin header is not present.
<FromGitter> <eliasjpr> I recommend to having a separate pipeline when possible for CORS requests
<FromGitter> <eliasjpr> For Firefox note: The Origin header is not set on Fetch requests with a method of HEAD or GET (this behavior was corrected in Firefox 65 — see bug 1508661).
<FromGitter> <eliasjpr> The issue could be fix by simply changing this line to a call next handler https://github.com/amberframework/amber/blob/7dab4b531af5e9b58fe192dcddecaa4459f9403d/src/amber/pipes/cors.cr#L48