Web wallet broken by CORS

[diachedelic]

Running on [email protected]

Grin is built from master#9a4895c8

Running the web wallet gives me the following error:

First error from devtools:

Access to XMLHttpRequest at 'http://localhost:13420/v1/wallet/owner/node_height' 
from origin 'http://localhost:13421' has been blocked by CORS policy: 
No 'Access-Control-Allow-Origin' header is present on the requested resource.

Owner API is definitely running:

$ lsof -i -P | grep LISTEN | grep grin
grin      68644 me   24u  IPv4 0x3700e1bf808ea46b      0t0  TCP localhost:13413 (LISTEN)
grin      68644 me   25u  IPv4 0x3700e1bf76e56aeb      0t0  TCP *:13414 (LISTEN)
grin      69059 me    5u  IPv4 0x3700e1bf7e437deb      0t0  TCP localhost:13421 (LISTEN)
grin      69059 me   16u  IPv4 0x3700e1bf7cab646b      0t0  TCP localhost:13420 (LISTEN)

[diachedelic]

• Chrome: Version 71.0.3578.98 (Official Build) (64-bit)
• Firefox: 51.0.1 (64-bit)

[codeb2cc]

The create_ok_response and response function in wallet/src/controller.rs is missing header("access-control-allow-headers", "Content-Type")

[diachedelic]

@codeb2cc actually, it appears that the browser is receiving a Basic authentication challenge:

# General
Request URL: http://localhost:13420/v1/wallet/owner/node_height
Request Method: GET
Status Code: 401 Unauthorized
Remote Address: 127.0.0.1:13420
Referrer Policy: no-referrer-when-downgrade
# Response
content-length: 0
date: Tue, 18 Dec 2018 00:35:05 GMT
www-authenticate: Basic realm=GrinOwnerAPI

Because the 401 response does not have an Access-Control-Allow-Origin header, it throws a CORS error.

Chrome console output:

GET http://localhost:13420/v1/wallet/owner/node_height 401 (Unauthorized)

Access to XMLHttpRequest at 'http://localhost:13420/v1/wallet/owner/node_height' from origin 'http://127.0.0.1:13421' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

[okjintao]

Run chrome using

open -a Google\ Chrome --args --disable-web-security --user-data-dir

then open the page

[mikeyb]

I use the plugin moesif-origin-cors-change on chrome to bypass cors issue when hitting localhost apps. I prefer that over running with --disable-web-security

[0xmichalis]

The web wallet is archived/non functional - this issue can be closed @yeastplume

[quentinlesceller]

Closing.