Expand description
allowCrossDomain: the CORS headers every response carries, and the preflight answer.
Upstream mounts this as the first middleware on the API router (ParseServer.ts:312), and
the ordering matters: the headers are set on every response, including error responses, and the
OPTIONS short-circuit happens before anything else can reject the request.
Why this is not optional, given that the JavaScript SDK never triggers a preflight. The SDK
sends everything as a text/plain POST precisely to stay inside the CORS “simple request”
rules, so no OPTIONS is ever issued. That is the fact that makes it tempting to skip this
layer, and it is only half the mechanism: a simple request is sent without a preflight, but
the browser still refuses to hand the response to the page unless
Access-Control-Allow-Origin is on it. Without these headers a browser-hosted SDK sees a
network error on every call while the server log shows 200s. Any client that does preflight,
which includes parse-dashboard and anything sending X-Parse-* headers directly, gets a 405
from the router instead, because OPTIONS is registered on no route.
The four headers and the exact OPTIONS behavior are reproduced from middlewares.js:399-422.
Constants§
- DEFAULT_
ALLOWED_ HEADERS DEFAULT_ALLOWED_HEADERS(middlewares.js:18-19), verbatim and in upstream’s order.
Functions§
- layer
- Set the CORS headers on every response, and answer a preflight directly.