let allowedOrigins = [/\.forestadmin\.com$/]
if (process.env.CORS_ORIGINS) {
allowedOrigins = allowedOrigins.concat(process.env.CORS_ORIGINS.split(','))
}
app.use(
cors({
origin: allowedOrigins,
allowedHeaders: ['Authorization', 'X-Requested-With', 'Content-Type'],
maxAge: 86400, // NOTICE: 1 day
credentials: true
})
)
I tried also to add the origin using CORS_ORIGIN env variable, without any luck.
Context
I host the forest express server on Heroku.
If I rollback to a previously built version, everything works fine. But if a rebuilt the same version, here comes again the issue. I honestly don’t know how to investigate from here.
The project name is Pégase Support. There are two “remote” environments now: production and debug. They relate to two different node express servers, hosted on heroku, the second being a copy of the first:
production points to https://pegase-forest-support.herokuapp.com. The server has been built on Nov 5 2020.
debug points to https://pegase-forest-support-debug.herokuapp.com. The server uses the exact same code as the previous one, and has the exact same env variables. It has been built today, Feb 9 2021.
production works fine, but if I rebuilt the server, the problem occurs, I have to rollback. For debug, the problem occurs.
For any table I open, the two following requests fail with a “CORS error” (heroku logs a 503 request timeout)
production (working build)
GENERAL
Request URL: https://pegase-forest-support.herokuapp.com/forest/warning?fields%5Bwarning%5D=createdAt&page%5Bnumber%5D=1&page%5Bsize%5D=15&searchExtended=0&sort=-createdAt&timezone=Europe%2FParis
Request Method: GET
Status Code: 200 OK
Remote Address: 34.240.104.255:443
Referrer Policy: strict-origin-when-cross-origin
REQUEST HEADER
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://app.forestadmin.com
Connection: keep-alive
Content-Length: 4168
Content-Type: application/json; charset=utf-8
Date: Tue, 09 Feb 2021 18:51:30 GMT
Etag: W/"1048-VtQcLP/tcAPkgVRVeZk/Z97IDUU"
Server: Cowboy
Vary: Origin
Via: 1.1 vegur
X-Powered-By: Express
About rollback, I use the heroku rollback feature Releases and Rollbacks | Heroku. I doesn’t recompile to a previous state, it just move back to a previous state. After I recompile the project I got the issue. I use the same code.
My investigation led me to create a brand new project using the same database for which I faced a postgresql/sequelize issue. I decided then to take a deeper look at this part of my main project too:
I upgraded pg from 6.1.0 to 8.5.1.
Then I faced the “self signed certificate” sequelize error which was solved setting the rejectUnauthorized sequelize option.
And then nothing, it was working smoothly
I do not not why the pg version was an issue. Neither I understand the consequences of setting rejectUnauthorized to false. Maybe you can enlighten me?
This error is thrown when the connection to your database is secured with SSL, but is using a self-signed certificate, and not a certificate that is signed by a known certificate authority.
I don’t know how your DB is configured, but if you are actually using a self-signed certificate, then this option is legit and necessary to tell pg not to worry about the signature. It should be possible to install the certificate on your server for being able to check it without setting this option, but I don’t know how to proceed.
On the other hand, if the certificate is signed by a known authority, then setting this option is a problem and should be investigated.
!
