Add Support for RPC CORS

[jacktang]

Hello,

Now ganache does not provide address searching, and can I use eth explorer(https://github.com/carsenk/explorer) and let it connect to ganache?

[mikeseese]

I don't believe Ganache currently supports RPC CORS which looks like a requirement for your eth explorer. This will definitely be a low priority, but we're open for pull requests! If someone wants to work this, please comment on this issue before you get started so we can talk plan of attack.

[dinostabOMG]

Possibly related: when trying to connect in browser through web3, Firefox will not accept the request and returns this error:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost:7545/. (Reason: missing token ‘user-agent’ in CORS header ‘Access-Control-Allow-Headers’ from CORS preflight channel).

Chrome doesn't disallow connection for this reason, so that is a workaround. However if it would take only the header token to make this work, it seems like it could be useful. I'm a bit new to the related issues but I would be willing to take a whack at fixing this and making a pull request, @seesemichaelj .

[mikeseese]

@dinostabOMG If you want to take a stab at it, that'd be great! I'm not quite sure how deep this rabbit hole may go. Let me know if you end up giving up for whatever reason so I can know that you're no longer working it.

Thanks! Let me know if you have any questions

[dinostabOMG]

Thanks. Did you want to talk plan of attack kind of stuff? It would be useful to be pointed at where RPC requests are handled, I think.

[dinostabOMG]

Is it not in this repo? It looks like what we're after is here:

https://github.com/trufflesuite/ganache-core/blob/develop/lib/httpServer.js

Still sussing out the relationship between the repos ganache, ganache-core, and ganache-cli, though.

[davidmurdoch]

@dinostabOMG web3/web3.js#1803 is likely related to the issue you are having with not being able to read the user-agent in the CORS request.

A temporary workaround seems to be to use ./dist/web3.min.js instead of the npm module directly.

[dinostabOMG]

Thanks @davidmurdoch . This is in reference to the same issue, but as pointed out in that thread, it isn't a bug in web3.js, it's a missing response header from the server application. Which in our case, is ganache (or perhaps ganache-core?)

Arguably, you could say that Firefox should not request the User-Agent header - and I'm not sure why it makes that request with the webpacked version but not the minified version. But in either case, we could solve the problem by sending the header, if I understand correctly.

[benjamincburns]

@dinostabOMG Thanks for looking into this!

We're going to try and cut a release of the full ganache suite on Monday evening or Tuesday morning PDT. I'd love to include your PR in that, but no pressure if you don't make it in time.

In the mean time a PR for this would be perfect if by default it allowed access from any referral domain but also added support for a string corsdomain field to our options object which at a minimum would respond to the CORS preflight with an Access-Control-Allow-Origin value that matches whatever the user sets.

We'd likely accept a PR without that, but if we were doing it ourselves that'd be how we'd go about it.

Also please be sure to include a test so that we don't regress on this feature!

[dinostabOMG]

While investigating, I learned that I glommed onto the wrong issue with my above comment about Firefox. However, that problem was a very simple fix to ganache-core, reflected in this PR

I'll do a separate pull request for affecting domain control when I get that figured out... dunno if it will be before the next release unfortunately, since that's quite tight.

[mikeseese]

Closing via trufflesuite/ganache#142

[dinostabOMG]

Does this actually resolve the issue as reported though? There's still no option to restrict CORS to specified domains as Benjamin requested. My PR only adds one header that Firefox requested.

[mikeseese]

CC @davidmurdoch ☝️

[davidmurdoch]

@dinostabOMG, you're correct. We've opened trufflesuite/ganache#143 to finish out the access-control-request-headers feature and we'll be tracking the custom CORS domain enhancement in trufflesuite/ganache#150