GraphQl Cors Support #31484

G-Arvind · 2020-12-29T13:21:58Z

Description (*)

Added support for CORS in Magento 2 GraphQl

This PR was Inspired from https://github.com/graycoreio/magento2-cors.

Related Pull Requests

Fixed Issues (if relevant)

Fixes [EY] Support CORS for GraphQL #31195

Manual testing scenarios (*)

In env.php add the allowed origins, methods, max-age, headers, and allow credentials details
make a request and check if the response is 200 or not

Questions or comments

Sample configuration (env.php)

'system' => [
     'default' => [
         'web' => [
             'graphql' => [
                 'cors_allowed_origins' => 'https://www.example.com, https://www.test.com',
                 'cors_allowed_methods' => 'GET, POST',
                 'cors_allowed_headers' => 'Content-Type',
                 'cors_max_age' => '86400',
                 'cors_allow_credentials' => 1
             ]
         ]
     ]
 ]

to allow all origins cors_allowed_origins => *

Contribution checklist (*)

Pull request has a meaningful description of its purpose
All commits are accompanied by meaningful commit messages
All new or changed code is covered with unit/integration tests (if applicable)
All automated tests passed successfully (all builds are green)

m2-assistant · 2020-12-29T13:22:00Z

Hi @G-Arvind. Thank you for your contribution
Here is some useful tips how you can test your changes using Magento test environment.
Add the comment under your pull request to deploy test or vanilla Magento instance:

@magento give me test instance - deploy test instance based on PR changes
@magento give me 2.4-develop instance - deploy vanilla Magento instance

❗ Automated tests can be triggered manually with an appropriate comment:

@magento run all tests - run or re-run all required tests against the PR changes
@magento run <test-build(s)> - run or re-run specific test build(s)
For example: @magento run Unit Tests

<test-build(s)> is a comma-separated list of build names. Allowed build names are:

Database Compare
Functional Tests CE
Functional Tests EE,
Functional Tests B2B
Integration Tests
Magento Health Index
Sample Data Tests CE
Sample Data Tests EE
Sample Data Tests B2B
Static Tests
Unit Tests
WebAPI Tests

You can find more information about the builds here

ℹ️ Please run only needed test builds instead of all when developing. Please run all test builds before sending your PR for review.

For more details, please, review the Magento Contributor Guide documentation.

⚠️ According to the Magento Contribution requirements, all Pull Requests must go through the Community Contributions Triage process. Community Contributions Triage is a public meeting.

🕙 You can find the schedule on the Magento Community Calendar page.

📞 The triage of Pull Requests happens in the queue order. If you want to speed up the delivery of your contribution, please join the Community Contributions Triage session to discuss the appropriate ticket.

🎥 You can find the recording of the previous Community Contributions Triage on the Magento Youtube Channel

✏️ Feel free to post questions/proposals/feedback related to the Community Contributions Triage process to the corresponding Slack Channel

G-Arvind · 2020-12-30T03:51:41Z

@magento run all tests

G-Arvind · 2020-12-30T05:12:38Z

@magento run all tests

G-Arvind · 2020-12-30T06:25:23Z

@magento run all tests

dthampy

@G-Arvind . Thank you for your work.
One suggestion though:
Currently, the integration tests we have for GraphQl are located under this path
dev/tests/integration/testsuite/Magento/ and we should not have them under app/code directory.
For example, if you look one of the integration tests for GraphQl: dev/tests/integration/testsuite/Magento/GraphQlCache.
So if you could move this "CorsGraphQlTest" to the appropriate directory and update the namespace, that'd be great.
Please check any of the existing Graphql integration test
( ex: CategoriesWithProductsCacheTest.php) for reference
Also, please remember to run this test locally to make sure there are no failures.
Thanks!

G-Arvind · 2021-01-13T07:07:09Z

@magento run all tests

dthampy · 2021-01-13T21:59:37Z

@G-Arvind , Looks like the below test is failing consistently. Not sure if you were able to reproduce this failure locally. Can you please take a look ? Might want to sync your branch with mainline/2.4-develop.

Magento\Catalog\Api\ProductRepositoryInterfaceTest::testCreateAllStoreCode with data set #1 (array('psku-test-2', 'sku-5ffea1807e1d56.19367581', 4, 'virtual', 3.62, 1, 4, array(array('cost', ''), array('description', 'Description'))))
SoapFault: Backend fetch failed

dthampy · 2021-01-14T03:29:48Z

dev/tests/integration/testsuite/Magento/GraphQl/Controller/CorsGraphQlTest.php

+        $this->assertNotFalse($response->getHeader('Access-Control-Allow-Origin'));
+        $this->assertNotFalse($response->getHeader('Access-Control-Allow-Headers'));
+        $this->assertNotFalse($response->getHeader('Access-Control-Allow-Methods'));
+        $this->assertNotFalse($response->getHeader('Access-Control-Max-Age'));


@G-Arvind , Please make sure to assert that the $response ->getContent() doesn't have any errors. Also, to assert that you get the productData back.

Verified that the response is not having any errors, also validated the response

dthampy · 2021-01-14T03:37:08Z

dev/tests/integration/testsuite/Magento/GraphQl/Controller/CorsGraphQlTest.php

+        $this->assertFalse($response->getHeader('Access-Control-Allow-Headers'));
+        $this->assertFalse($response->getHeader('Access-Control-Allow-Methods'));
+        $this->assertFalse($response->getHeader('Access-Control-Max-Age'));
+    }


It'd be great if you could add an additional use case by setting the http method "OPTIONS" to the request since CORS allow this method. Please remember to add the assertion that the response doesn't have any errors.
Thanks.

Added OPTIONS test case with error validation.

damienwebdev · 2021-03-01T21:10:54Z

This is clearly a copy-pasta of my module. https://github.com/graycoreio/magento2-cors

While my code is MIT-licensed, you can't simply rename a class and remove my copyright.

Please at least add the appropriate attribution.

PascalBrouwers · 2021-03-01T21:43:12Z

If Magento merges this without the copyright they're also in copyright violation 🙊

prabhuram93 · 2021-03-01T23:20:43Z

This is clearly a copy-pasta of my module. https://github.com/graycoreio/magento2-cors

While my code is MIT-licensed, you can't simply rename a class and remove my copyright.

Please at least add the appropriate attribution.

@damienwebdev thanks for pointing it out. We will review this issue.

davemacaulay · 2021-03-02T15:16:10Z

@damienwebdev thanks for raising this issue, we're going to hold this PR while we review this internally and determine the best course of action. Rest assured we always intend to attribute the correct author in any work contributed.

G-Arvind · 2021-03-02T16:43:08Z

This is clearly a copy-pasta of my module. https://github.com/graycoreio/magento2-cors

While my code is MIT-licensed, you can't simply rename a class and remove my copyright.

Please at least add the appropriate attribution.

Hi @damienwebdev , the intention was not to copy paste and i also didn't copy paste your work, i kept your module as an inspiration/reference and re-created the functionality, the requirements are also same like using env for storing config instead of saving in admin etc. So it is appearing as a copy paste. Iterating again, i had no intention to copy paste your module. Thanks.

I have added appropriate attribution, sorry for missing it out earlier.

Thanks.

damienwebdev · 2021-03-02T17:29:58Z

@G-Arvind, not particularly mad about it. I just want to make sure the attribution is included. If we want to discuss specifics of the PR where I'm concerned you did in-fact copy-paste...

Consider: yours and mine

Yes, you made two small improvements to the function, and you moved the function. But, the body of that function is otherwise a raw copy/paste with some small modifications.

I'll gladly admit that the module is not something mind-blowingly novel and the HeaderProvider behavior is a core feature that we both utilize, so the similarities of those are natural products of Core. Your constant choices are eerily similar (albeit natural).

Your interfacing is also eerily similar, yours and mine

Finally, it's rather suspicious that your code is missing Access-Control-Expose-Headers and Vary: Origin exactly as mine was until literally yesterday when I fixed it.

I get that you took inspiration from my code -- it's MIT-licensed intentionally. But, it's important that if you're going to use someone else's code, you properly attribute it. Simply including in the PR @damienwebdev or referencing the repo on the Github PR would have been sufficient so that your reviewers know that the code came from somewhere.

This is also an important part of the Adobe CLA -- you agreed when you signed it that your code is in-fact your own and not based upon anyone else's.

i kept your module as a reference/inspiration

Is enough to get Adobe into trouble if this code had been merged without attribution. I would wholly have been in my rights to DMCA the Magento 2 repo for that. Would I do that? Absolutely not, that would be stupid and the antithesis of the progress that FOSS works towards.

damienwebdev · 2021-03-02T17:35:16Z

As a code-review comment, to move past the copyright issues:

I also think that this PR is incomplete as it stands. Many of the features that are included in my module are missing from here. For example, there's a nasty DoS vulnerability (I leave this to the reader to figure out on their own) that can occur if you use this code with an http in-memory cache (e.g. Varnish) and do not include the Vary header.

In addition, these are the following necessary headers

Access-Control-Allow-Origin
Access-Control-Allow-Methods
Access-Control-Allow-Headers
Access-Control-Max-Age
Access-Control-Expose-Headers
Access-Control-Allow-Credentials

You are missing Access-Control-Expose-Headers.

Additionally, you should not apply the headers to both the preflight request AND the actual request, you should apply

Access-Control-Allow-Origin
Access-Control-Allow-Credentials

to both, and

Access-Control-Allow-Methods
Access-Control-Allow-Headers
Access-Control-Max-Age
Access-Control-Expose-Headers

specifically to the Preflight only.

damienwebdev · 2021-03-05T17:19:16Z

@nrkapoor merging this PR will also necessitate changes to existing VCL for Varnish, idk who the CodeOwners of Varnish are, could you include them as reviewers as well?

m2-community-project bot added the Priority: P1 Once P0 defects have been fixed, a defect having this priority is the next candidate for fixing. label Dec 29, 2020

magento-engcom-team added Component: GraphQL GraphQL Release Line: 2.4 Partner: EY partners-contribution Pull Request is created by Magento Partner labels Dec 29, 2020

m2-community-project bot added the Progress: pending review label Dec 29, 2020

G-Arvind force-pushed the magento-2-graphql-cors branch from 4b0c66d to 89be26c Compare December 30, 2020 04:46

cors support

b5bb41f

G-Arvind force-pushed the magento-2-graphql-cors branch from 89be26c to b5bb41f Compare December 30, 2020 06:25

keharper mentioned this pull request Jan 3, 2021

GraphQL: Document CORS support magento/devdocs#8465

Closed

8 tasks

gabrieldagama added the Project: GraphQL label Jan 5, 2021

dthampy suggested changes Jan 12, 2021

View reviewed changes

m2-community-project bot assigned dthampy Jan 12, 2021

m2-community-project bot added Progress: needs update and removed Progress: pending review labels Jan 12, 2021

refactored integration test files

152ff37

dthampy suggested changes Jan 14, 2021

View reviewed changes

added assertions

849f053

m2-community-project bot added Progress: review and removed Progress: needs update labels Jan 18, 2021

nrkapoor requested a review from damienwebdev March 5, 2021 17:14

m2-community-project bot added Progress: pending review and removed Progress: review labels Dec 7, 2022

ishakhsuvarov removed the Project: GraphQL label Dec 8, 2022

m2-community-project bot added Progress: review and removed Progress: pending review labels Dec 8, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GraphQl Cors Support #31484

GraphQl Cors Support #31484

G-Arvind commented Dec 29, 2020 •

edited

Loading

m2-assistant bot commented Dec 29, 2020

G-Arvind commented Dec 30, 2020

G-Arvind commented Dec 30, 2020

G-Arvind commented Dec 30, 2020

dthampy left a comment

G-Arvind commented Jan 13, 2021

dthampy commented Jan 13, 2021 •

edited

Loading

dthampy Jan 14, 2021

G-Arvind Jan 18, 2021

dthampy Jan 14, 2021 •

edited

Loading

G-Arvind Jan 18, 2021

damienwebdev commented Mar 1, 2021 •

edited

Loading

PascalBrouwers commented Mar 1, 2021

prabhuram93 commented Mar 1, 2021

davemacaulay commented Mar 2, 2021

G-Arvind commented Mar 2, 2021

damienwebdev commented Mar 2, 2021 •

edited

Loading

damienwebdev commented Mar 2, 2021 •

edited

Loading

damienwebdev commented Mar 5, 2021

GraphQl Cors Support #31484

Are you sure you want to change the base?

GraphQl Cors Support #31484

Conversation

G-Arvind commented Dec 29, 2020 • edited Loading

Description (*)

Related Pull Requests

Fixed Issues (if relevant)

Manual testing scenarios (*)

Questions or comments

Contribution checklist (*)

m2-assistant bot commented Dec 29, 2020

G-Arvind commented Dec 30, 2020

G-Arvind commented Dec 30, 2020

G-Arvind commented Dec 30, 2020

dthampy left a comment

Choose a reason for hiding this comment

G-Arvind commented Jan 13, 2021

dthampy commented Jan 13, 2021 • edited Loading

dthampy Jan 14, 2021

Choose a reason for hiding this comment

G-Arvind Jan 18, 2021

Choose a reason for hiding this comment

dthampy Jan 14, 2021 • edited Loading

Choose a reason for hiding this comment

G-Arvind Jan 18, 2021

Choose a reason for hiding this comment

damienwebdev commented Mar 1, 2021 • edited Loading

PascalBrouwers commented Mar 1, 2021

prabhuram93 commented Mar 1, 2021

davemacaulay commented Mar 2, 2021

G-Arvind commented Mar 2, 2021

damienwebdev commented Mar 2, 2021 • edited Loading

damienwebdev commented Mar 2, 2021 • edited Loading

damienwebdev commented Mar 5, 2021

G-Arvind commented Dec 29, 2020 •

edited

Loading

dthampy commented Jan 13, 2021 •

edited

Loading

dthampy Jan 14, 2021 •

edited

Loading

damienwebdev commented Mar 1, 2021 •

edited

Loading

damienwebdev commented Mar 2, 2021 •

edited

Loading

damienwebdev commented Mar 2, 2021 •

edited

Loading