6 ms·

Unfortunately this caching is still per-path. For example: GET /v1/document/{document-id}/comments/{comment-id} For every new document-id or comment-id, t

Unfortunately this caching is still per-path. For example: GET /v1/document/{document-id}/comments/{comment-id} For every new document-id or comment-id, there will be a new pre-flight request. Alternative hacks: Offer a variant of your API format that either 1. Moves the resource path to the request body (or to a header that is included in "Vary"). Though the rest of your stack (load balancing, observability, redaction) might not be ok with this, e.g. do your WAF rules support matching on the request body? You also will no longer get automatic path-based caching for GET requests. 2. Conforms to the rules of a CORS "simple" request [1], which won't trigger a pre-flight request. This is what we did on the Dropbox API [2]. You'll need to move the auth information from the Authorization header to a query parameter or the body, which can be dangerous wrt redaction, e.g. many tools automatically redact the Authorization header but not query parameters. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simpl... [2] https://www.dropbox.com/developers/documentation/http/documentation https://www.dropbox.com/developers/documentation/http/docume... (see "Browser-based JavaScript and CORS pre-flight requests")

enlyth 4y ago
> Offer a variant of your API format that either: 1. Moves the resource path to the request body GraphQL ducks
- danwee 4y ago
  > GraphQL And now you have two problems
  - pas 4y ago
    But you have a nice schema for your problem :) GQL is a bit ugly, but works well, kind of standardized, etc. Is there something similar for providing a batch endpoint for OpenAPI requests?
    - marcofatica 4y ago
      GET /blog/1?with=comments,author&only=title,body,created_at,comments.body,author.name
  - enlyth 4y ago
    I got N+1 problems but CORS ain't one
Cthulhu_ 4y ago
3. Don't allow cross-platform requests in the first place; have your API consumers go through a server-side proxy on the same domain instead, or host it on the same domain in the first place.
- icedchai 4y ago
  Yes, CORS is best avoided when your own back end is the "third party." (In some cases, it may be impossible though.)
- cakoose 4y ago
  > 3. Don't allow cross-platform requests in the first place; have your API consumers go through a server-side proxy on the same domain instead, or host it on the same domain in the first place. That works for first-party JS. Doesn't work for a public API used by others. Edit: Specifically purely client-side apps. For someone hosting a static HTML+JS app, it's annoying to have to set up and run a server-side route just to circumvent CORS. (Maybe not so bad with something like Next.js, where it's easy to add a backend route to your primarily static website.) And it adds an extra hop of latency to every request.
- zmxz 4y ago
  This is the only valid solution and the easiest one to implement. However, for some reason unknown to me - younger devs and various organizations simply refuse to go down this route and make up reasons why it doesn't work for them, opting for more time-consuming alternatives.
  - LunaSea 4y ago
    If you serve your static files from a CDN it's simply not possible to do so. It's a very common case.
    - tylerhou 4y ago
      IIRC Cloudflare has page rules, which makes this possible? In fact, with page rules, Cloudflare can proxy a subpath (like /api) to a completely different domain.
nmjenkins 4y ago
> Moves the resource path to the request body JMAP is very well suited to CORS due to this: https://www.rfc-editor.org/rfc/rfc8620.html https://www.rfc-editor.org/rfc/rfc8620.html
three14 4y ago
To hijack the thread a bit, if you are still with Dropbox, could you get them to implement what you did in #2 in the official Dropbox JS SDK? Right now it still does a pre-flight request for everything.
- cakoose 4y ago
  No, I left Dropbox 5 years ago. But it might be easy to add? https://github.com/dropbox/dropbox-sdk-js/blob/main/src/dropbox.js https://github.com/dropbox/dropbox-sdk-js/blob/main/src/drop... Make sure to always set the URL parameter "reject_cors_preflight=true", which will make sure you're not inadvertently triggering pre-flight requests.
giancarlostoro 4y ago
> Conforms to the rules of a CORS "simple" request [1], which won't trigger a pre-flight request. I was about to ask if OPTIONS would be sufficient, but it looks like some of the MDN URLs suggest just that.
yencabulator 4y ago
Yeah. For example, the Meilisearch search engine recommends submitting idempotent searches over POST and not GET due to this: https://docs.meilisearch.com/reference/api/search.html https://docs.meilisearch.com/reference/api/search.html I wish they'd standardize HTTP QUERY soon: https://datatracker.ietf.org/doc/draft-ietf-httpbis-safe-method-w-body/ https://datatracker.ietf.org/doc/draft-ietf-httpbis-safe-met...

enlyth 4y ago

> Offer a variant of your API format that either: 1. Moves the resource path to the request body GraphQL ducks

danwee 4y ago
> GraphQL And now you have two problems
- pas 4y ago
  But you have a nice schema for your problem :) GQL is a bit ugly, but works well, kind of standardized, etc. Is there something similar for providing a batch endpoint for OpenAPI requests?
  - marcofatica 4y ago
    GET /blog/1?with=comments,author&only=title,body,created_at,comments.body,author.name
- enlyth 4y ago
  I got N+1 problems but CORS ain't one

Cthulhu_ 4y ago

3. Don't allow cross-platform requests in the first place; have your API consumers go through a server-side proxy on the same domain instead, or host it on the same domain in the first place.

icedchai 4y ago
Yes, CORS is best avoided when your own back end is the "third party." (In some cases, it may be impossible though.)
cakoose 4y ago
> 3. Don't allow cross-platform requests in the first place; have your API consumers go through a server-side proxy on the same domain instead, or host it on the same domain in the first place. That works for first-party JS. Doesn't work for a public API used by others. Edit: Specifically purely client-side apps. For someone hosting a static HTML+JS app, it's annoying to have to set up and run a server-side route just to circumvent CORS. (Maybe not so bad with something like Next.js, where it's easy to add a backend route to your primarily static website.) And it adds an extra hop of latency to every request.
zmxz 4y ago
This is the only valid solution and the easiest one to implement. However, for some reason unknown to me - younger devs and various organizations simply refuse to go down this route and make up reasons why it doesn't work for them, opting for more time-consuming alternatives.
- LunaSea 4y ago
  If you serve your static files from a CDN it's simply not possible to do so. It's a very common case.
  - tylerhou 4y ago
    IIRC Cloudflare has page rules, which makes this possible? In fact, with page rules, Cloudflare can proxy a subpath (like /api) to a completely different domain.

nmjenkins 4y ago

> Moves the resource path to the request body JMAP is very well suited to CORS due to this: https://www.rfc-editor.org/rfc/rfc8620.html https://www.rfc-editor.org/rfc/rfc8620.html

three14 4y ago

To hijack the thread a bit, if you are still with Dropbox, could you get them to implement what you did in #2 in the official Dropbox JS SDK? Right now it still does a pre-flight request for everything.

cakoose 4y ago
No, I left Dropbox 5 years ago. But it might be easy to add? https://github.com/dropbox/dropbox-sdk-js/blob/main/src/dropbox.js https://github.com/dropbox/dropbox-sdk-js/blob/main/src/drop... Make sure to always set the URL parameter "reject_cors_preflight=true", which will make sure you're not inadvertently triggering pre-flight requests.

giancarlostoro 4y ago

> Conforms to the rules of a CORS "simple" request [1], which won't trigger a pre-flight request. I was about to ask if OPTIONS would be sufficient, but it looks like some of the MDN URLs suggest just that.

yencabulator 4y ago

Yeah. For example, the Meilisearch search engine recommends submitting idempotent searches over POST and not GET due to this: https://docs.meilisearch.com/reference/api/search.html https://docs.meilisearch.com/reference/api/search.html I wish they'd standardize HTTP QUERY soon: https://datatracker.ietf.org/doc/draft-ietf-httpbis-safe-method-w-body/ https://datatracker.ietf.org/doc/draft-ietf-httpbis-safe-met...