-1

This answer about static to static (file:// -> file://) states that a webserver (http://) can be used to serve files to a local static page (file://) without violating CORS. And this answer states that when sending data from a webserver to a static page, a header of null must be used. But neither of the two lines below are working, so how do I do it?

func handler(w http.ResponseWriter, r *http.Request) {
    w.Header().Add("Access-Control-Allow-Origin", nil) //this line
    fmt.Fprintf(w, "Hi there, I love %s!", r.URL.Path[1:])
}

returns the error ./main.go:42: cannot use nil as type string in argument to w.Header().Add

func handler(w http.ResponseWriter, r *http.Request) {
    w.Header().Add("Access-Control-Allow-Origin", "")
    fmt.Fprintf(w, "Hi there, I love %s!", r.URL.Path[1:])
}

This compiles but throws the client side error: Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost:8080/aardvark/posts. (Reason: CORS header 'Access-Control-Allow-Origin' missing)

Community
  • 1
  • 1
Seph Reed
  • 8,797
  • 11
  • 60
  • 125

1 Answers1

2

After writing up this question, I thought to try one last thing out of desperation, and it worked.

func handler(w http.ResponseWriter, r *http.Request) {
    w.Header().Add("Access-Control-Allow-Origin", "null")
    fmt.Fprintf(w, "Hi there, I love %s!", r.URL.Path[1:])
}

You're supposed to set the string to "null", rather than a null string "" or nil

If you don't think this question belongs on SO, please leave a comment and I'll promptly take it down.

Seph Reed
  • 8,797
  • 11
  • 60
  • 125
  • Kudos! the implementations of NULL or absence of value are different among languages and platforms (i.e. JSON's is `null`, Python is `None`, Go is `nil`). For the HTTP Header, it's text-only format thus there is no way (and perhaps not desireable) for `nil` in Go to be converted to `null`. – Pandemonium Mar 13 '16 at 17:11
  • Never allow the `null` origin, esp. with credentials. Doing so exposes your users to cross-origin attacks. – jub0bs Mar 11 '23 at 08:29