Request headers are not properly forwarded #105
Description
While trying Electric Cloud, I found a bug where important request headers aren't sent to the electric client, which in this case, causes electric to see there being no access-control-allow-origin header, causing it to default to returning *.
This produces CORS errors in the browser when using credentials mode include
Access to fetch at 'https://api.myapp.com/sync/persons?offset=-1' from origin 'https://myapp.com' has been blocked by
CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response
must not be the wildcard '*' when the request's credentials mode is 'include'.
in http mode with
# config
config :phoenix_sync,
env: config_env(),
mode: :http,
url: "https://api.electric-sql.cloud",
credentials: [
secret: electric_cloud_secret,
source_id: electric_cloud_source_id
]
# controller
...
conn |> sync_render(params, query) |> dbg()
...You can see the request headers before, and the response headers after don't match.
conn #=> %Plug.Conn{
req_headers: [
{"origin", "https://myapp.com"},
]
}
|> sync_render(params, query) #=> %Plug.Conn{
req_headers: [
{"origin", "https://myapp.com"},
],
resp_headers: [
{"access-control-allow-origin", "*"}.
]
}It should be
sync_render(params, query) #=> %Plug.Conn{
req_headers: [
{"origin", "https://myapp.com"},
],
resp_headers: [
{"access-control-allow-origin", "https://myapp.com"}.
]
}