I have a reitit server and a reagent template and I'm trying to allow CORS. I've tried using wrap-cors from ring middleware but am having trouble getting it to work. Has anyone else experience this?

(def app2
  (ring/ring-handler
    (ring/router
      [["/" {:get {:handler index-handler}}]
       ["/items"
        ["" {:get {:handler index-handler}}]
        ["/:item-id" {:get {:handler    index-handler
                            :parameters {:path {:item-id int?}}}}]]
       ["/about" {:get {:handler index-handler}}]]
      {:data {:coercion   reitit.coercion.spec/coercion
              :muuntaja   m/instance
              :middleware [params/wrap-params
                           muuntaja/format-middleware
                           coercion/coerce-exceptions-middleware
                           coercion/coerce-request-middleware
                           coercion/coerce-response-middleware]}})
    (ring/create-default-handler)))

Hello!

I have cors working with reitit

here is what I have (cut-down...)

(def cors {"Access-Control-Allow-Origin" "*"
           "Access-Control-Allow-Headers" "Origin, Accept, Access-Control-Request-Method, Access-Control-Allow-Headers, Content-Type, *"})

where do you place the def cors?

(defn cors-handler
  [_]
  {:headers cors :status ok})

(defn router
  [app-config]
  (ring/router
   [["/api"
     ["/ping" {:get {:handler pong}}]
     ["/foobar"
      ["" {:options {:handler cors-handler}
...
...
...

ah so create a custom fn

All those are contained within one namespace

yes

then you can reuse eit

cool, I'll give it a shot! thanks!

/foobar also has a :post

so when the client does an options first, before the post, it'll hit the cors handler, get back a nice responsee, then invoke the post.

do you have to add this on every route? or can you add to the parent api/?

Doesn't cors mandate that before any dangerous operation, i.e., anything that can modify anything, like POST/PUT/DELETE, then the "options" is hit for that API endpoint

so, if you have POST /foo then the client would invoke a OPTIONS /foo

or a DELETE /foo an OPTIONS /foo

so maybe it has to go on each API, rather than the root

I only have one API endpoint atm, so have it against the /foobar route.

worth trying! 🙂

easy to test by moving the handler up a level.

(defn router
  [app-config]
  (ring/router
   [["/api"
     ["/ping" {:get {:handler pong}}]
     ["/foobar"
      ["" {:options {:handler cors-handler}
           :post {:handler (create-entry app-config)
                  :parameters {:body {:user-id s/Int
                                      :age s/Int}}}}]]

bbl - have to pop out - hope it works for you! 🙂

bad luck for me, still being blocked