fix: CORS headers incorrectly set for GET #36085

sampaiodiego · 2025-05-26T22:40:46Z

This pull request addresses an issue with CORS (Cross-Origin Resource Sharing) headers not being properly sent for GET requests in the Rocket.Chat API. It includes changes to the middleware logic and updates to the associated test cases to reflect the new behavior.

Fixes and Enhancements to CORS Handling:

apps/meteor/app/api/server/middlewares/cors.ts: Updated the middleware to always set the Access-Control-Allow-Origin header to * for GET requests, regardless of whether CORS is enabled in the settings.

Test Updates for CORS Behavior:

apps/meteor/app/api/server/middlewares/cors.spec.ts:
- Modified test descriptions and assertions to validate that the Access-Control-Allow-Origin header is included for GET requests, both when CORS is enabled and disabled. [1] [2] [3]

Proposed changes (including videos or screenshots)

Issue(s)

Fix #36054

Steps to test or reproduce

Further comments

dionisio-bot · 2025-05-26T22:40:50Z

Looks like this PR is ready to merge! 🎉
If you have any trouble, please check the PR guidelines

changeset-bot · 2025-05-26T22:40:50Z

🦋 Changeset detected

Latest commit: b87939a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 36 packages

Name	Type
@rocket.chat/meteor	Patch
@rocket.chat/core-typings	Patch
@rocket.chat/rest-typings	Patch
@rocket.chat/uikit-playground	Patch
@rocket.chat/api-client	Patch
@rocket.chat/apps	Patch
@rocket.chat/core-services	Patch
@rocket.chat/cron	Patch
@rocket.chat/ddp-client	Patch
@rocket.chat/freeswitch	Patch
@rocket.chat/fuselage-ui-kit	Patch
@rocket.chat/gazzodown	Patch
@rocket.chat/livechat	Patch
@rocket.chat/model-typings	Patch
@rocket.chat/ui-contexts	Patch
@rocket.chat/account-service	Patch
@rocket.chat/authorization-service	Patch
@rocket.chat/ddp-streamer	Patch
@rocket.chat/omnichannel-transcript	Patch
@rocket.chat/presence-service	Patch
@rocket.chat/queue-worker	Patch
@rocket.chat/stream-hub-service	Patch
@rocket.chat/license	Patch
@rocket.chat/omnichannel-services	Patch
@rocket.chat/pdf-worker	Patch
@rocket.chat/presence	Patch
rocketchat-services	Patch
@rocket.chat/models	Patch
@rocket.chat/network-broker	Patch
@rocket.chat/mock-providers	Patch
@rocket.chat/ui-avatar	Patch
@rocket.chat/ui-client	Patch
@rocket.chat/ui-video-conf	Patch
@rocket.chat/ui-voip	Patch
@rocket.chat/web-ui-registration	Patch
@rocket.chat/instance-status	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2025-05-26T22:47:00Z

PR Preview Action v1.6.1
🚀 View preview at https://RocketChat.github.io/Rocket.Chat/pr-preview/pr-36085/
Built to branch `gh-pages` at 2025-05-27 16:23 UTC. Preview will be ready when the GitHub Pages deployment is complete.

codecov · 2025-05-26T22:47:36Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 64.75%. Comparing base (93eb903) to head (b87939a).
Report is 2 commits behind head on release-7.7.0.

Additional details and impacted files

@@                Coverage Diff                @@
##           release-7.7.0   #36085      +/-   ##
=================================================
+ Coverage          64.20%   64.75%   +0.55%     
=================================================
  Files               3018     3110      +92     
  Lines              91839    93196    +1357     
  Branches           17433    17741     +308     
=================================================
+ Hits               58967    60351    +1384     
+ Misses             30185    30057     -128     
- Partials            2687     2788     +101

Flag	Coverage Δ
e2e	`58.41% <ø> (+1.74%)`	⬆️
unit	`71.52% <100.00%> (+0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Pull Request Overview

This PR fixes the issue with CORS headers not being correctly sent for GET requests in the Rocket.Chat API. It ensures that the Access-Control-Allow-Origin header is always set to "*" for GET requests and updates the test cases to validate this behavior.

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
apps/meteor/app/api/server/middlewares/cors.ts	Removes the conditional check and now always sets the allow-origin header for GET requests.
apps/meteor/app/api/server/middlewares/cors.spec.ts	Updates test cases to expect the Access-Control-Allow-Origin header and remove expectations for other CORS headers.
.changeset/fuzzy-bottles-unite.md	Updates changeset documentation to reflect the fix for GET CORS headers.

.changeset/fuzzy-bottles-unite.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull Request Overview

This PR fixes an issue with CORS headers for GET requests in the Rocket.Chat API by always setting the Access-Control-Allow-Origin header to "*" regardless of the CORS settings.

Updated the CORS middleware to always send the allow-origin header for GET requests.
Modified test cases to validate that the allow-origin header is always present for GET requests, and removed assertions for other CORS headers.
Added a changeset file for the patch release.

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
apps/meteor/app/api/server/middlewares/cors.ts	Updated middleware to always set the Access-Control-Allow-Origin header for GET requests.
apps/meteor/app/api/server/middlewares/cors.spec.ts	Revised tests reflecting the new CORS header behavior for GET requests.
.changeset/fuzzy-bottles-unite.md	Included changeset documentation for the patch update.

Copilot · 2025-05-27T16:04:48Z

apps/meteor/app/api/server/middlewares/cors.ts

-				res.headers.set('Access-Control-Allow-Methods', defaultHeaders['Access-Control-Allow-Methods']);
-				res.headers.set('Access-Control-Allow-Headers', defaultHeaders['Access-Control-Allow-Headers']);
-			}
+			res.headers.set('Access-Control-Allow-Origin', '*');


Consider adding an inline comment explaining that the Access-Control-Allow-Origin header is always set for GET requests, clarifying that this behavior is intentional as part of the fix.

sampaiodiego · 2025-06-03T19:36:47Z

/backport 7.6.3

Co-authored-by: Guilherme Gazzo <guilherme@gazzo.xyz> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

dionisio-bot · 2025-06-03T19:37:23Z

Pull request #36139 added to Project: "Patch 7.6.3"

sampaiodiego added 2 commits May 26, 2025 19:38

fix: CORS headers incorrectly set for GET

b1d8e7b

docs: add changeset

c334a87

sampaiodiego changed the base branch from develop to release-7.7.0 May 26, 2025 22:40

sampaiodiego added this to the 7.7.0 milestone May 26, 2025

ggazzo marked this pull request as ready for review May 27, 2025 15:54

Copilot AI review requested due to automatic review settings May 27, 2025 15:54

Copilot AI reviewed May 27, 2025

View reviewed changes

ggazzo requested a review from Copilot May 27, 2025 15:56

Copilot AI reviewed May 27, 2025

View reviewed changes

.changeset/fuzzy-bottles-unite.md Outdated Show resolved Hide resolved

Update .changeset/fuzzy-bottles-unite.md

b87939a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ggazzo requested a review from Copilot May 27, 2025 15:57

Copilot AI reviewed May 27, 2025

View reviewed changes

ggazzo added the stat: QA assured Means it has been tested and approved by a company insider label May 27, 2025

dionisio-bot bot added the stat: ready to merge PR tested and approved waiting for merge label May 27, 2025

ggazzo merged commit 2f38213 into release-7.7.0 May 27, 2025
44 checks passed

ggazzo deleted the fix-cors-headers branch May 27, 2025 17:42

rocketchat-github-ci mentioned this pull request May 27, 2025

Release 7.7.0 #36031

Merged

dionisio-bot bot pushed a commit that referenced this pull request Jun 3, 2025

fix: CORS headers incorrectly set for GET (#36085)

114f4a4

Co-authored-by: Guilherme Gazzo <guilherme@gazzo.xyz> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

dionisio-bot bot mentioned this pull request Jun 3, 2025

fix: CORS headers incorrectly set for GET #36139

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: CORS headers incorrectly set for GET #36085

fix: CORS headers incorrectly set for GET #36085

Uh oh!

sampaiodiego commented May 26, 2025 •

edited by ggazzo

Loading

Uh oh!

dionisio-bot bot commented May 26, 2025 •

edited

Loading

Uh oh!

changeset-bot bot commented May 26, 2025 •

edited

Loading

Uh oh!

github-actions bot commented May 26, 2025 •

edited

Loading

Built to branch `gh-pages` at 2025-05-27 16:23 UTC.
Preview will be ready when the GitHub Pages deployment is complete.

Uh oh!

codecov bot commented May 26, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI May 27, 2025

Uh oh!

Uh oh!

sampaiodiego commented Jun 3, 2025

Uh oh!

dionisio-bot bot commented Jun 3, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

fix: CORS headers incorrectly set for GET #36085

fix: CORS headers incorrectly set for GET #36085

Uh oh!

Conversation

sampaiodiego commented May 26, 2025 • edited by ggazzo Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Fixes and Enhancements to CORS Handling:

Test Updates for CORS Behavior:

Proposed changes (including videos or screenshots)

Issue(s)

Steps to test or reproduce

Further comments

Uh oh!

dionisio-bot bot commented May 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented May 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

github-actions bot commented May 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Built to branch gh-pages at 2025-05-27 16:23 UTC. Preview will be ready when the GitHub Pages deployment is complete.

Uh oh!

codecov bot commented May 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI May 27, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sampaiodiego commented Jun 3, 2025

Uh oh!

dionisio-bot bot commented Jun 3, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sampaiodiego commented May 26, 2025 •

edited by ggazzo

Loading

dionisio-bot bot commented May 26, 2025 •

edited

Loading

changeset-bot bot commented May 26, 2025 •

edited

Loading

github-actions bot commented May 26, 2025 •

edited

Loading

Built to branch `gh-pages` at 2025-05-27 16:23 UTC.
Preview will be ready when the GitHub Pages deployment is complete.

codecov bot commented May 26, 2025 •

edited

Loading