Altair: Why the app start to send OPTIONS request (after update from 2.3.8 to 2.4.0)?

[someden]

Some servers don't have proper settings for OPTIONS request, so after update chrome extension from 2.3.8 to 2.4.0 you will have some errors, for example:
Server response:

No route found for "OPTIONS /graphql": Method Not Allowed (Allow: POST, GET)

Console error:

Access to XMLHttpRequest at 'http://my.api/graphql' from origin 'chrome-extension://flnheeellpciglgpaodhkhmapeljopja' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Maybe you should provide some workarounds or some advices in docs for those cases.

Desktop (please complete the following information):

• OS: macOS Catalina 10.15.2 (19C57)
• Browser Chrome 79.0.3945.88 (Official Build) (64-bit)
• Altair GraphQL Client Version 2.4.0

[welcome[bot]]

👋🏾Thanks for opening your first issue here! Be sure to follow the issue template! ✌🏾

[imolorhe]

I don't think this error began in v2.4.0. CORS has always been an aspect of sending requests from the browser extensions. However, there is another known issue with v2.4.0 which is #1125 and is going to be fixed in the next version. I can't do anything about CORS related errors. To go around that, you should use the desktop version of the app. That handles CORS errors better, For more information on the CORS, check this article: https://sirmuel.design/altair-graphql-web-app-limitations-b671a0a460b8

Medium

Altair GraphQL Web App Limitations

TL;DR — It is recommended to use Altair desktop apps. If not, prefer browser extensions. Only use web app as a last resort.

[XAKEPEHOK]

@imolorhe, I am totally disagree with you. CORS needed for restrict evil.com fetch some data from example.com. Both are simple sites. But Altair (for me it is chrome extension) - not site, it is a tool for developers. And as chrome extension (as tool), it should not respect CORS.

After 2.4.0 Altair became unusable for me, and I rollback to simple extension ChromeiQL. I can't use desktop version of Altair, because I use Altair for checking developed by me GraphQL API. Often, in development process I make some mistakes (500 errors), which I can see in Chrome Dev Tools network tab (right in Altair extension). It is not possible with desktop app.

Really, after update, Altair not usable for me now

[imolorhe]

@XAKEPEHOK do you mean after you updated to v2.4.2? If not, you should update. Like I mentioned before, the CORS error has always been there and nothing I did changed that. However there was the other issue which had been fixed in 2.4.2 and no one is complaining anymore. Please check the latest version. If you still have the CORS issue, I don't think I can help you with that unfortunately.

[imolorhe]

Btw browser extensions follow the CORS policy as well. Just thought I should mention that.

[XAKEPEHOK]

At 2.4.2 everything ok, thank you!

[joshjg]

With version 2.4.2 I am still experiencing the same issue.

[XAKEPEHOK]

With version 2.4.2 I am still experiencing the same issue.

Yes, you right. My comment above is wrong, because my colleague changed Access-Control-Allow-Origin in dev env to *.

@imolorhe, I still think, that Altair browser extension (in Chrome/Chromium) should not respect CORS and do not send OPTIONS request. Instead of this, it should use permissions with url pattern <all_urls>

[imolorhe]

I still think, that Altair browser extension (in Chrome/Chromium) should not respect CORS and do not send OPTIONS request.

@XAKEPEHOK The chrome/chromium team are moving towards enforcing the CORS policy on browser extensions. I've readded the permissions (currently permitting http://*/ and https://*/) that were missing previously (would be available in v2.4.3), but I can't guarantee that the chrome team wouldn't enforce CORS more strictly in the future.

https://www.chromium.org/Home/chromium-security/extension-content-script-fetches