parcel server starts without CORS enabled

[roscom]

❔ Question

when starting parcel serve, is there a way/undocumented option to set the CORS policy as in:

access-control-allow-origin: *

🔦 Context

I have a cycle.js app querying an external URL and I use parcel index.html as the dev server. ?
Unforunately, the CORS policy is not set and therefore the the app is blocked from accessing the data.

💻 Code Sample

🌍 Your Environment

package.json:
{
"name": "wikipedia",
"version": "1.0.0",
"description": "search wikipedia",
"main": "index.js",
"scripts": {
"start": "parcel -p 1235 index.html",
"test": "echo "Error: no test specified" && exit 1"
},
"keywords": [],
"author": "cb",
"license": "ISC",
"dependencies": {
"@cycle/dom": "^22.3.0",
"@cycle/http": "^15.1.0",
"@cycle/run": "^5.2.0",
"npm": "^6.6.0",
"xstream": "^11.10.0"
},
"devDependencies": {}
}

Software	Version(s)
Parcel	1.11.0
Node	8.11.4
npm/Yarn	npm 6.6.0
Operating System	Linux cb-8 4.18.0-13-generic #14-Ubuntu SMP Wed Dec 5 09:04:24 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

[mischnic]

It should work by default:

parcel/packages/core/parcel-bundler/src/Server.js

Lines 23 to 33 in 6cbf2a6

	function enableCors(res) {
	res.setHeader('Access-Control-Allow-Origin', '*');
	res.setHeader(
	'Access-Control-Allow-Methods',
	'GET, HEAD, PUT, PATCH, POST, DELETE'
	);
	res.setHeader(
	'Access-Control-Allow-Headers',
	'Origin, X-Requested-With, Content-Type, Accept, Content-Type'
	);
	}

[lustoykov]

I was not able to reproduce that Parcel doesn't allow other origins. My assumption is that @roscom tries to query another website from their parcel server and the other website doesn't allow the origin.

[felixfbecker]

It looks like Parcel does not send CORS headers when a file wasn't found, which can lead to confusing errors in the browser as the CORS errors obscure the 404 error

[DeMoorJasper]

changed this to good first feature as errors should probably also have cors headers

[Taym95]

Hey @DeMoorJasper, thank you for your amazing work on parcel, I would like to work on this issue, can you give a piece of advice where I should start?

[DeMoorJasper]

You could call setHeaders(res) in send500 and send404

https://github.com/parcel-bundler/parcel/blob/master/packages/core/parcel-bundler/src/Server.js#L81-L111