"Invalid CORS configuration" error

[alokmahor]

I have added CORS config in config/development.yaml as

middlewares:
    cors:
      enable: true
      allow_origin: "http://localhost:5173" # You can replace "*" with "http://localhost:5173" for better security
      allow_methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"]
      allow_headers: ["Authorization", "Content-Type"]
      allow_credentials: true

This Configuration gives me error

thread 'main' panicked at /Users/alok/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tower-http-0.6.2/src/cors/mod.rs:798:9:
Invalid CORS configuration: Cannot combine `Access-Control-Allow-Credentials: true` with `Access-Control-Allow-Origin: *`

What is wrong in my Configuration?

[kaplanelad]

The CORS functionality is implemented using the tower-http crate. You can view the relevant logic here.

[unlearnt]

solution is this incase someone is having the same problem..

middlewares:
cors:
enable: true
allow_origins: ["http://localhost:5173"]
allow_methods: [ "GET", "POST", "PUT", "DELETE", "OPTIONS" ]
allow_headers: [ "Authorization", "Content-Type" ]
expose_headers: [ "Content-Length", "Content-Type" ]
allow_credentials: true

[kaplanelad]

Do you think we should improve the documentation here?
https://loco.rs/docs/the-app/controller/#cors

Or is this something you'd expect users to already be familiar with when working with CORS?

[unlearnt]

Do you guys accept commit on the docs? As i can help with the documentation since i will be experimenting with loco and I've already encounter some of the frequently encountered issue such as CORS and .env issues.

Anyway to answer your question, it would be helpful to add it to the docs, the confusion here seems to be the parameter conventions
he was using allow_origin:"" but the fool-proof way would be using allow_origins:[""]

[kaplanelad]

Absolutely — we're happy to accept pull requests!
You're more than welcome to help improve our documentation.