Apollo Server resetting CORS options

Question

Apollo server just ignores my CORS layer and applies its own options.

Despite setting the CORS middleware with the option to reflect the origin with the following code:

    var corsOptions = {
       origin: true,  //This will just copy the request origin and put it in response
       optionsSuccessStatus: 200, 
       credentials: true, 
    };
    app.use(cors(corsOptions));

    const apolloServer = new ApolloServer({ schema, context , playground: true}); 
    await apolloServer.start();

   //Integrate with express
   apolloServer.applyMiddleware({app, path: '/api/graphql', cors: corsOptions});

Apollo server just ignores my CORS layer and returns 'Access-Control-Allow-Origin' : "\*" and because of that I get a CORS error because:

the value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

If the goal was to make the other post more searchable, you could have suggested an edit to its title rather than writing a whole new question. — jonrsharpe, Apr 09 '21 at 14:32

score 0 · Accepted Answer · answered Apr 09 '21 at 14:26

To fix the problem you will need to provide CORS options directly inside applyMiddleware method. Like this:

var corsOptions = {
           origin: true,  //This will just copy the request origin and put it in response
           optionsSuccessStatus: 200, 
           credentials: true, 
        };
apolloServer.applyMiddleware({app, path: '/api/graphql', cors: corsOptions}); //WE ADDED CORS HERE

Here is a link to stack overflow discussion with the same problem.

Also, if interested the offical documentation says the following.

Apollo Server resetting CORS options

1 Answers1