Hi we have a react-ts (v0.30.2) frontend and pytho...
# support-questionsd
DylanH
02/13/2023, 6:23 PMHi we have a react-ts (v0.30.2) frontend and python-fastapi (v0.12.1) backend. Amid various issues with CORS, we are now having the problem that requests to the signin/signup are being responded with 200oks from the backend, including the st-access-token, but the browser is not being redirected to the index. Any ideas why this might happen?
r
rp
02/13/2023, 6:27 PMhey @DylanH
rp
02/13/2023, 6:28 PMCan you show me a screenshot of the cookie store post login?
d
DylanH
02/13/2023, 6:28 PMsure, give me a second
DylanH
02/13/2023, 6:29 PMnot sure if this is what you mean, I'm new to frontend stuff
r
rp
02/13/2023, 6:30 PMyou need to upgrade the frontend SDK to the latest version
d
DylanH
02/13/2023, 6:30 PMAh great will do
DylanH
02/13/2023, 6:32 PMthanks so much that works!
r
rp
02/13/2023, 6:34 PMok cool
d
DylanH
02/14/2023, 11:14 AMFurther to the CORS issues I mentioned yesterday, do you have any clue why backend endpoints using Depends(verify_session()) might return cors errors. The preflight options requests seem to work and correctly return the right accept-control-origin header, as do unprotected endpoints. I am hosting the backend on ngrok, if that perhaps creates issues. When I send requests the backend doesn't even appear to receive the actual request after the preflight request.
r
rp
02/14/2023, 11:15 AMso the actual request is sent by the browser or not?
d
DylanH
02/14/2023, 11:17 AMIt appears to be
r
rp
02/14/2023, 11:17 AMbut i guess the response is not read by the browser cause of cors error
rp
02/14/2023, 11:17 AMthis usually happens if you have added the cors middleware AFTER your api routes.
rp
02/14/2023, 11:17 AMyou want to make sure that the cors middleware runs before any of your APIs
d
DylanH
02/14/2023, 11:18 AMyeah I have done that here, but I was trying it before, let me move it in front again and retest
DylanH
02/14/2023, 11:18 AMafter the supertokens middleware though I take it
r
rp
02/14/2023, 11:18 AMno
rp
02/14/2023, 11:18 AMbefore
d
DylanH
02/14/2023, 11:18 AMah
DylanH
02/14/2023, 11:21 AMhmm it still seems to be failing, and now I don't see the options requests
DylanH
02/14/2023, 11:22 AMapp = fastapi.FastAPI(title="Dummy APP")
app.add_middleware(
CORSMiddleware,
allow_origins=[app_info.website_domain],
allow_credentials=True,
allow_methods=["GET", "PUT", "POST", "DELETE", "OPTIONS", "PATCH"],
allow_headers=["Content-Type"] + supertokens_python.get_all_cors_headers(),
# allow_headers=["Content-Type", "x-st-cookie", "id-refresh-token", "anti-csrf", "front-token"] + supertokens_python.get_all_cors_headers(),
# expose_headers=["x-st-cookie", "id-refresh-token", "anti-csrf", "front-token"],
)
app.add_middleware(supertokens_fastapi.get_middleware())
app.include_router(...)
r
rp
02/14/2023, 11:24 AM"now I don't see the options requests" -> as in the OPTIONS request fails too?
d
DylanH
02/14/2023, 11:26 AMah never mind it appears the preflight check was just cached or something, it is still working
DylanH
02/14/2023, 11:26 AMbut the actual requests are still failing
r
rp
02/14/2023, 11:26 AMwhats the cors error?
d
DylanH
02/14/2023, 11:27 AMAccess to XMLHttpRequest at 'https://ec4d-213-86-169-34.eu.ngrok.io/auth/get_user' from origin 'https://kaleidoscopic-beijinho-b469f6.netlify.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
DylanH
02/14/2023, 11:28 AMinteresting that it has that / at the end of the origin
DylanH
02/14/2023, 11:28 AMoh that appears to be a copying error
DylanH
02/14/2023, 11:29 AMAccess to XMLHttpRequest at 'https://ec4d-213-86-169-34.eu.ngrok.io/auth/get_user' from origin 'https://kaleidoscopic-beijinho-b469f6.netlify.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
r
rp
02/14/2023, 12:05 PMright. Im not sure. I think the CORS middleware isn't setup properly
d
DylanH
02/14/2023, 12:07 PMhmm its weird Ive tried it with the starlette version and the fastapi version
DylanH
02/14/2023, 12:07 PMbut I guess the fastapi version is just a wrapper around the other one
r
rp
02/14/2023, 12:19 PM@KShivendu can help here
k
KShivendu
02/14/2023, 12:28 PMHey @DylanH can you turn on your ngrok server again? I doubt if ngrok is altering something.
d
DylanH
02/14/2023, 2:40 PMI think I figured it out in the end - turns out that ngrok was sending a browser warning page (i.e. that you are entering an ngrok server) instead of responding appropriately to the request
DylanH
02/14/2023, 2:40 PMthanks so much both for the help though