Empty origin header doesn't work about rocket_cors

[adimarco]

This seems to be due to the lack of an "Origin" header in my curl request. When I set an Origin header it works.

According to Mozilla, the "Origin" header can be blank - https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Origin though it appears that's not currently supported as rocket_cors is written. (I tried the curl with an -H "Origin: " to send it the empty string)

[lawliet89]

The header can be blank, but there is no value in handling a blank origin. Your browser will always send the Origin header when making a request to something from a different origin. Tools like curl do not have this behaviour and your routes will work just fine without the header. See https://www.w3.org/TR/cors/#resource-processing-model

[lawliet89]

You can test with the following example:

#![feature(plugin)]
#![plugin(rocket_codegen)]
extern crate rocket;
extern crate rocket_cors;

use rocket::http::Method;
use rocket_cors::{AllowedOrigins, AllowedHeaders};

#[get("/")]
fn get<'a>() -> &'a str {
    "Hello CORS"
}

#[put("/")]
fn put<'a>() -> &'a str {
    "Hello CORS"
}

#[post("/")]
fn post<'a>() -> &'a str {
    "Hello CORS"
}

#[delete("/")]
fn delete<'a>() -> &'a str {
    "Hello CORS"
}

fn main() {
    let (allowed_origins, failed_origins) = AllowedOrigins::some(&["http://www.test-cors.org"]);
    assert!(failed_origins.is_empty());

    // You can also deserialize this
    let options = rocket_cors::Cors {
        allowed_origins: allowed_origins,
        allowed_methods: vec![Method::Get, Method::Put, Method::Post, Method::Delete]
            .into_iter()
            .map(From::from)
            .collect(),
        allowed_headers: AllowedHeaders::some(&["Authorization", "Accept"]),
        allow_credentials: true,
        ..Default::default()
    };

    rocket::ignite()
        .mount("/", routes![get, put, post, delete])
        .attach(options)
        .launch();
}

From the test-cors.org website. For example, to test PUT:

     Running `target/debug/examples/test-cors`
🔧  Configured for development.
    => address: localhost
    => port: 8000
    => log: normal
    => workers: 8
    => secret key: generated
    => limits: forms = 32KiB
    => tls: disabled
🛰  Mounting '/':
    => GET /
    => PUT /
    => POST /
    => DELETE /
🛰  Mounting '/cors':
    => GET /cors/<status>
📡  Fairings:
    => 0 launch: 
    => 1 request: CORS
    => 1 response: CORS
🚀  Rocket has launched from http://localhost:8000
OPTIONS /:
    => Error: No matching routes for OPTIONS /.
    => Warning: Responding with 404 Not Found catcher.
    => CORS Fairing: Turned missing route OPTIONS / into an OPTIONS pre-flight request
    => Response succeeded.
PUT /:
    => Matched: PUT /
    => Outcome: Success
    => Response succeeded.

[lawliet89]

@adimarco: I am assuming that you have no further issue with this. Please reopen or raise a new issue if something new arises.

[Arignir]

I got brained by this issue the first time I tried rocket_cors, and adimarco and I probably aren't the only one. Took me quite a lot of googling to find out the missing Origin was the key.

Handling no/default Origin would be great to make rocket_cors easier to understand, and help them understand they aren't doing anything wrong when they try the crate for the first time.

[lawliet89]

Do you mean you would like the crate to inject the CORS response headers even when the browser does not include any CORS related request headers?