[ENG-3583] Respect cors_allowed_origins for backend HTTP requests

[masenf]

Some test code

import reflex as rx


pinging = rx._x.client_state(default=False)
ping_success = rx._x.client_state(default=False)
fetch_response = rx._x.client_state(default="")


def index() -> rx.Component:
    # Welcome Page (Index)
    return rx.container(
        rx.color_mode.button(position="top-right"),
        rx.vstack(
            rx.heading("Welcome to Reflex!", size="9"),
            # Comment the following two lines to make a stateless app
            rx.text(f"my sid: {rx.State.router.session.session_id}"),
            rx.text(f"my token: {rx.State.router.session.client_token}"),
            rx.hstack(
                pinging,         ######
                ping_success,    ##  Client state vars
                fetch_response,  ######
                rx.button(
                    "Ping",
                    size="4",
                    disabled=pinging.value,
                    color_scheme=rx.cond(
                        pinging.value,
                        "blue",
                        rx.cond(ping_success.value, "green", "red"),
                    ),
                    on_click=rx.run_script("{"
                        f"{pinging.set_value(True)}(); "
                        f"{fetch_response.set_value('')}(); "
                        "fetch(getBackendURL(env.PING))"
                        f".then((data) => {{ {ping_success.set}(data.ok); data.text().then({fetch_response.set}) }})"
                        f".catch((error) => {{ {ping_success.set_value(False)}(); {fetch_response.set}(error.message) }})"
                        f".finally({pinging.set_value(False)}); "
                    "}"),
                ),
                rx.cond(
                    fetch_response.value != "",
                    rx.text(fetch_response.value),
                    rx.cond(pinging.value, rx.spinner()),
                ),
                align="center",
            ),
        ),
        rx.logo(),
    )


app = rx.App()
app.add_page(index)

in rxconfig.py

import reflex as rx

config = rx.Config(
    app_name="repro_cors",
    cors_allowed_origins=["http://localhost:3001", "http://localhost:3000"],
)

Running the app stateless with various combinations of cors_allowed_origins shows that CORS is now respected on the HTTP connection.

CORS has been respected on the websocket connection for quite a while, but for some reason all origins were being allowed to other backend HTTP routes, like _upload and ping. Now those are protected by the starlette CORSMiddleware.

[linear]

ENG-3583 The app doesn't respect CORS