CORS error when communicating between subdomains (port-forward wildcard)

Hi! First of all thanks for the community server to talk about this topic!

While setting up Coder and getting used to it with my dev environment, I realized that when I port forward from dashboard using "arbitary" port forward, I realized that when I send request to backend express node server from my react page, it throws CORS preflight error.

I digged in some more and realized that request without header works fine but as soon as I set the header, it throws CORS error.
I checked that it works fine in my local dev environment so I am bit confused.
Also, I think the cookie and body information disappears as well.

I suspect that this happens because Coder checks if the user is authenticated or not,
so I will try modify template to add button without permission check (

share = "public"

share = "public"

) and see what happens.
(It will be awesome to configure port forward setting in the browser as well)

I found related issue and also commented there as well!
https://github.com/coder/coder/issues/5706#issuecomment-1519939084

Thanks

GitHub

CORS is not permitted between multiple subdomain workspace apps · ...

I'm using coder with caddy to dev my backend project but when using forwarded port api url with XMLHttpRequest (Vue axios) it occurs error Access to XMLHttpRequest at 'https://8001--dev--xx...

Codercord•4/24/23, 11:38 AM

<#1100023050864435200>

**Category**

Help needed

**Product**

Coder OSS (v2)

**Platform**

Linux

Logs

Please post any relevant logs/error messages.

Jjj1122_Hi! First of all thanks for the community server to talk about this topic! Whil...

Phorcys•4/24/23, 12:32 PM

yeah so the main reason this isn't implemented yet i assume is due to safety concerns

Phorcys•4/24/23, 12:33 PM

from what I understand you're trying to make a request from a page served by a

coder_app

coder_app

to another one, correct ?

PPhorcys yeah so the main reason this isn't implemented yet i assume is due to safety con...

Phorcys•4/24/23, 12:33 PM

this is unsafe because it would allow a page from your workspace to request a page that's in another one

Phorcys•4/24/23, 12:35 PM

there isn't really any workaround other than :
1. setup a reverse-proxy like caddy and serve those on different routes
2. port-forward to your local machine on different ports

PPhorcys from what I understand you're trying to make a request from a page served by a `...

jj1122_OP•4/25/23, 9:47 AM

Both frontend and backend are served by same workspace but in different ports.

Also you suggested to change CORS setting and check

Referer

Referer

header in backend on Github Issue. I did that and realized that when CORS is blocked, nothing gets passed to the backend server. I assume that the request is blocked by the

coder

coder

it self.

Phorcys•4/25/23, 9:49 AM

you can't change the CORS policy yourself, my suggestion was something that needs to be changed in the product itself

Phorcys•4/25/23, 9:50 AM

also by backend I meant the coder reverse-proxy one, it was only a suggestion to make your use-case possible while still maintaining security

basically, when you access a

coder_app

coder_app

or a port-forwarded host, what happens is the following :
client (browser) <-> coder server <-> requested app/port

currently the issue lies in the fact that the coder server sends a CORS policy that doesn't allow subdomains to communicate with eachother, this is the case to prevent from accidental data exposure.

I suggested we allow subdomains to communicate with eachother and that the coder server should check the origin page and the destination page to see if the workspace is the same, that way we can avoid security holes

PPhorcys there isn't really any workaround other than : 1. setup a reverse-proxy like cad...

Phorcys•4/25/23, 9:50 AM

so for now, you can't do much except that or wait

PPhorcys also by backend I meant the coder reverse-proxy one, it was only a suggestion to...

jj1122_OP•4/25/23, 9:52 AM

thank you for the clarification! I will try the workaround method you suggested and see how it goes!

PPhorcys there isn't really any workaround other than : 1. setup a reverse-proxy like cad...

jj1122_OP•4/25/23, 10:09 AM

Just a quick question, setting caddy up on the workspace won't help as it still uses