Altair: Unable to send requests to 127.0.0.1 using Altair GraphQL Client 2.3.6

[Kars-de-Jong]

Describe the bug
I am unable to send requests (either for docs or queries). The developer tools Console tab shows the following error:

Access to XMLHttpRequest at 'http://127.0.0.1:9090/graphql' from origin 'altair://-' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

To Reproduce
Steps to reproduce the behavior:

1. Request for docs or send a query.
2. See error in Console.

Desktop

• OS: MacOS Mojave
• Altair GraphQL Client 2.3.6

Additional context
It works fine with version 2.3.5. Unfortunately I can't seem to stop the auto-upgrade from happening.

[welcome[bot]]

👋🏾Thanks for opening your first issue here! Be sure to follow the issue template! ✌🏾

[heeeunkimmm]

I have the exact same issue-

[imolorhe]

Thanks for reporting this! I'd look into it as soon as I can.

[imolorhe]

As a temporary fix, you can set the Origin header to your localhost URL (e.g. http://127.0.0.1:9090) in the header modal and see if that works. I am still having troubles reproducing the issue locally for now.

[imolorhe]

Looks like the temporary fix doesn't work either 😕

[imolorhe]

From my tests so far, the requests work fine if there is no error, but it throws this error when the server request has an error (404 in my case)

[heeeunkimmm]

The dark theme is from the 2.3.6 version and light theme is from the 2.3.5 version, both connecting to the same localhost. Feels like some of the fields on Request Header is not being set properly. Let me know if you need any other info - hopefully this screenshot helps.

[imolorhe]

@heeeunkimmm Can you test same thing in one of the browser extensions (Chrome/Firefox)? Also in v2.3.5 can you set the following headers:

• Origin as altair://-
• Sec-Fetch-Mode as cors
• Sec-Fetch-Site as cross-site

[Kars-de-Jong]

Re: headers not being sent, that's also why my service returned 404 (a missing header).

[imolorhe]

@Kars-de-Jong @heeeunkimmm Can you try this build and let me know if it fixes the issue for you? https://www.dropbox.com/s/yaw8r4gxj1bpiw2/altair_2.3.6_mac.zip?dl=0

Dropbox

altair_2.3.6_mac.zip

Shared with Dropbox

[Kars-de-Jong]

@imolorhe That fixes it for me, thanks!

[imolorhe]

Thanks for confirming. That narrows it down. The problem is with the latest version of electron (v7.0.0). I'll downgrade back to version 6 and release the new version

[imolorhe]

The issue with electron has already been reported here https://github.com/electron/electron/issues/20730. Hopefully that gets fixed soon.

[Hubro]

What is the status on this? I also have this issue, basically rendering Altair unusable for me. That's a pretty serious bug :/

What's the point of enforcing CORS on a local development utility anyway? Doesn't Electron have a way of disabling it, something equivalent to --disable-web-security on Chromium?

[imolorhe]

This issue was fixed a year ago now

[Hubro]

This issue was fixed a year ago now

I'm having the same exact problem on version 2.4.13

[imolorhe]

What exactly is the error you're receiving? Did you also try checking the headers you receive on the server side, and the errors in the developer tools console? Also have you tried a newer version of Altair?

[Hubro]

What exactly is the error you're receiving? Did you also try checking the headers you receive on the server side, and the errors in the developer tools console? Also have you tried a newer version of Altair?

The exact error this issue was opened for:

Access to XMLHttpRequest at 'http://127.0.0.1:5000/graphql' from origin 'altair://-' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

There are the headers that Altair are getting from the OPTIONS request:

Allow: HEAD, OPTIONS, GET, POST
Content-Length: 0
Content-Type: text/html; charset=utf-8
Date: Sat, 03 Oct 2020 11:48:05 GMT
Server: Werkzeug/1.0.1 Python/3.8.5

If I set Access-Control-Allow-Origin: * in the response headers then Altair can send requests, but that breaks several of the fetch calls in my client application for other Chrome security reasons.

I have not tried version 2.5, as 2.4.13 is the one available in AUR on Arch Linux. I can try upgrading and see if that does anything.

[imolorhe]

Can you also show your Altair settings JSON you have?

[imolorhe]

Also Altair allows you set the Origin header to something that your server would expect.

[Hubro]

I haven't touched my settings at all. I assume you mean the settings.json file under .config:

{
    "altair_windowsMeta": "{\"activeWindowId\":\"85a961ae-2716-440a-8d40-fae4419f322f\",\"windowIds\":[],\"showImportCurlDialog\":false,\"showEditCollectionDialog\":false,\"showSettingsDialog\":false,\"showEnvironmentManager\":false,\"showPluginManager\":false}",
    "altair_environments": "{\"base\":{\"title\":\"Environment\",\"variablesJson\":\"{}\"},\"subEnvironments\":[]}",
    "altair_settings": "{\"theme\":\"dark\",\"language\":\"en-US\",\"addQueryDepthLimit\":3,\"tabSize\":2,\"theme.editorFontFamily\":\"Source Code Pro\"}",
    "altair_windows": "{}"
}%

I have tried setting the Origin header using the headers editor, but it doesn't work. I still get the exact same error.

To clarify, I have set the header "Origin" to "127.0.0.1" and "http://127.0.0.1:5000", and both seem to be ignored as I get the exact same error.

[imolorhe]

Can you check the headers you actually receive on the server side? I just tested with v2.5.1 installed locally (setting "Origin" to "127.0.0.1") and I received the origin header set to 127.0.0.1 on the server side.

[Hubro]

Can you check the headers you actually receive on the server side? I just tested with v2.5.1 installed locally (setting "Origin" to "127.0.0.1") and I received the origin header set to 127.0.0.1 on the server side.

Alright never mind. I guess my outdated flag on the altair package in AUR yesterday prompted the maintainer to update it. I have now installed version 2.5.1 and everything just works by default now, without any CORS headers sent by the server and no Origin header override in Altair.

Sorry for bumping an old issue and wasting your time :)