CurrentUser query fails CORS

[Irev-Dev]

When deploying an app that has authentication with serverless (the api is on a different domain with this setup) there seems to be a CORS issue that only effects the currentUser query.

Where as other queries using the same graphQL endpoint don't have the same problem. I had posted this on the forum, after which I strongly suspected this was a bug and not a config problem so thought making a minimum replicating project was the best way to proceed. See that project here.

https://github.com/Irev-Dev/redwood-serverless-cors-demo

It covers steps to replicate with the website I've deployed as will as what steps I took to make the project.

---

Other than the project I have tried to dig into this myself adding some extra logging to a deployed api to see if something strange was happening when deployed, so I logged out lambdaResponse in packages/graphql-server/src/functions/graphql.ts and checking in Cloudwatch showed the following:

    {
      body: '{"data":{"redwood":{"currentUser":null}}}',
      statusCode: 200,
      headers: {
        'access-control-allow-credentials': 'true',
        'access-control-allow-origin': '*'
      }
    }

So it seems the headers are been added but are lost somewhere along the way?
To be clear I'm happy to keep digging into this, but I'm not sure where to look other than packages/graphql-server/src/functions/graphql.ts now, so need some help.

[Irev-Dev]

Closing this issue because it's not a bug, extra steps in the serverless.yml are needed when using the graphql endpoint for auth/credentials.

'*' is not good enough for CORS for requests with credentials. this was the diff that fixed it for me in my test project.

Though @thedavidprice @virtuoushub does this have implications for the serverless setup commend? if we detect they have an auth provider we add this to the serverless config?

[thedavidprice]

Though @thedavidprice @virtuoushub does this have implications for the serverless setup commend? if we detect they have an auth provider we add this to the serverless config?

💯

We should assume projects have Auth as the default.

@Irev-Dev could you add this topic as something to address/discuss on #3755?

Thanks!

[Irev-Dev]

@thedavidprice Done!

#3755 (comment)