Need assistance with Cors and Options pre-flight request

[fendyk]

Currently for my application when trying to access routes (Post for example), CORS is required and it will try a so called 'pre-flight' request using the OPTIONS method. How would I approach this with this library? Maybe a @options decorator could be possible? Or is there a better approach?

[fendyk]

Just figured out I can use:
@Post({ extraMethods: [HttpMethod.OPTIONS] })

In case anyone is wondering.

[alaughlin]

Is there a simpler way to apply this to all API routes without adding it to every one individually?

[ggurkal]

As of this moment, there isn't a simpler way to apply it to all routes.

[alaughlin]

Got it. The other issue I'm seeing is that while { extraMethods: [HttpMethod.OPTIONS] } is responding to preflight checks with a 200 for GET, it isn't for POST, PATCH, etc. Is there something else that needs to done?

[fendyk]

Got it. The other issue I'm seeing is that while { extraMethods: [HttpMethod.OPTIONS] } is responding to preflight checks with a 200 for GET, it isn't for POST, PATCH, etc. Is there something else that needs to done?

Yes, you need to create a Cors middleware.

[alaughlin]

yeah I just figured that out, was able to apply a basic Cors() middleware to all of my handler classes like this:

export const Cors = createMiddlewareDecorator((req: NextApiRequest, res: NextApiResponse, next: NextFunction) => {
    if (req.method == 'OPTIONS') {
        return res.status(200).json({});
    }
    next();
})

[fendyk]

Here's my CORS middleware if you need it

import {createMiddlewareDecorator, NextFunction, UnauthorizedException} from "next-api-decorators";
import {NextApiRequest, NextApiResponse} from "next";
import NextCors from "nextjs-cors";

const Cors = createMiddlewareDecorator(
    async (req: NextApiRequest, res: NextApiResponse, next: NextFunction) => {
        return await NextCors(req, res, {
            // Options
            methods: ['GET', 'HEAD', 'PUT', 'PATCH', 'POST', 'DELETE', 'OPTIONS'],
            origin: JSON.parse(process.env.CORS_ORIGINS!),
            optionsSuccessStatus: 200, // some legacy browsers (IE11, various SmartTVs) choke on 204
            credentials: true,
            exposedHeaders: [
                'X-Total-Count',
                'Access-Control-Max-Age'
            ],

        }).catch((e) => {
            console.log(e)
        });
    }
);

export default Cors;