We’re trying to set up ServiceStack and CORS within our test environment. Currently there is no IIS security set up (anonymous). When trying to connect from the client (React) the request is rejected with:
“Access to fetch at ‘https://xxx?format=json’ from origin ‘http://localhost:3000’ has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. If an opaque response serves your needs, set the request’s mode to ‘no-cors’ to fetch the resource with CORS disabled.”
We’ve tried the below to set up ServiceStack but we’re unsure if this is a server setup issue or a client setup issue. The ServiceStack project is hosted on a test server where the client is just running a localhost:3000 React project. The React project has been able to connect with a Rails API call. Is there an example of how to connect to a React project? The GET and Post work, but the Put and Delete do not.
Here's my request:
const https = require("https");
function deleteStaffMember(e) {
console.log(e.currentTarget.name)
try {
const res = fetch(`https://xxx/${e.currentTarget.name}?format=json`, {
method: 'DELETE',
agent: new https.Agent({
rejectUnauthorized: false
}),
mode: 'cors',
credentials: 'omit' --also tried 'include'
})
} catch(err) {
console.log(err)
}
}
Here are the AppHost service stack attempts, from current to previous attempts:
public override void Configure(Container container)
{
//Permit modern browsers (e.g. Firefox) to allow sending of any HTTP Method
SetConfig(new HostConfig
{
GlobalResponseHeaders = {
{ “Access-Control-Allow-Origin”, “*” },
{ “Access-Control-Allow-Methods”, “GET, POST, PUT, DELETE, OPTIONS” },
{ “Access-Control-Allow-Headers”, “Content-Type” },
},
});
}
**earlier:**
Plugins.Add(new CorsFeature(
allowOriginWhitelist: *,
allowCredentials: false,
allowedHeaders: *));
**even earlier:**
Plugins.Add(new CorsFeature(
allowOriginWhitelist: new[] { “http://localhost”,“http://localhost:3000” },
allowCredentials: true,
allowedHeaders: “Content-Type, Allow, Authorization, X-Args”));
**original:**
Plugins.Add(new CorsFeature());
Here's my DELETE (I assume this doesn't get as much because it's the pre-flight request):
DELETE /NDBServiceStack/staff/hierarchy/1315 Origin: [http://localhost:3000](http://localhost:3000/) Referer: http://localhost:3000/index Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Safari/605.1.15
