Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Access-Control-Allow-Credentials’ header is ” #8687

Closed
nirina-apiqa opened this issue Apr 28, 2018 · 8 comments
Closed

Access-Control-Allow-Credentials’ header is ” #8687

nirina-apiqa opened this issue Apr 28, 2018 · 8 comments

Comments

@nirina-apiqa
Copy link

nirina-apiqa commented Apr 28, 2018 •
edited by lindy65
Loading

Summary

I got Access-Control-Allow-Credentials’ header is ‘’ in response after trying to connect with mattermost server along with its Rest api

Steps to reproduce

Install mattermost server ver 4.9 deb file for linux
Configure it to run on localhost
setup a javascript application to interact with the server using the mattermost javascript driver located at https://github.com/mattermost/mattermost-redux
Try to connect a user account to the server using the api call POST http://localhost:8065/api/v4/users/login

Expected behavior

After entering the right credentials, I expected to receive session token

Observed behavior (that appears unintentional)

I got an error: Response to preflight request doesn’t pass access control check: Credentials flag is ‘true’, but the ‘Access-Control-Allow-Credentials’ header is ‘’. It must be ‘true’ to allow credentials

Possible fixes

set header Access-Control-Allow-Credentials to true
@lieut-data
Copy link
Member

@nirina-apiqa, that appears to be a CORS error, emitted by your browser.

I'm assuming you're running Mattermost on localhost:8065, but then running your JavaScript application on a different port on localhost? By default, your browser is trying to protect you from a malicious website that would access an API on your behalf but without your consent.

If you're just developing, you can follow the instructions on https://docs.mattermost.com/administration/config-settings.html?highlight=cors#enable-cross-origin-requests-from to override the CORS setting in Mattermost and allow the connection. Another option might be to develop a plugin which runs as part of Mattermost. See https://developers.mattermost.com/extend/plugins/ for more details.

Let us know if this resolves your issue :)

@lindy65
Copy link
Contributor

lindy65 commented May 9, 2018

Hi @nirina-apiqa

Has lieut-data's information helped resolve your issue?

@amyblais
Copy link
Member

Hi @nirina-apiqa , we haven't received an update so we'll assume that the problem is fixed or is no longer valid.

If you still experience the same problem, try upgrading to the latest version.

If the issue persists, reopen this issue with the relevant information and we'd be glad to help you where we can.

@iampeter
Copy link

iampeter commented Jul 2, 2018

@lieut-data @amyblais The official 5.0.0 version seems to have the same problem, where following the instructions for setting CORS to accept "*" doesn't seem to work.

@lieut-data
Copy link
Member

Hi @iampeter! Here's something that works for me (in Chrome), when I load this file directly into the browser:

<!DOCTYPE html>
<html>
    <head>
        <title>Test</title>
    </head>
    <body>
        <script>
            fetch('http://localhost:8065/api/v4/system/ping').then((response) => {
                if (response.status !== 200) {
                    console.log('Looks like there was a problem. Status Code: ' + response.status);
                    return;
                }

                response.json().then(console.log);
            });
        </script>
    </body>
</html>

With AllowCorsFrom set to the default "", it fails with the expected CORS error, but with it set to "*", I get the expected response logged to the system console.

Can you describe what you're seeing?

@amyblais amyblais reopened this Jul 3, 2018
@iampeter
Copy link

iampeter commented Jul 3, 2018

@lieut-data maybe this should go to the mattermost-redux repo then, because your example indeed works for me, but what does not work is Client4.getMe() from mattermost-redux:

Failed to load http://localhost:8065/api/v4/users/me: Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Credentials' header in the response is '' which must be 'true' when the request's credentials mode is 'include'. Origin 'http://localhost:8081' is therefore not allowed access.

@iampeter iampeter mentioned this issue Jul 3, 2018
Closed
@iampeter
Copy link

iampeter commented Jul 3, 2018

Reported my problem as mattermost/mattermost-redux#557

@lieut-data
Copy link
Member

Sounds good -- let's carry on the conversation there.

@crspeller crspeller mentioned this issue Jul 24, 2018
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@iampeter @lieut-data @lindy65 @amyblais @nirina-apiqa