cors doesn't apply to next(e) ... about cors HOT 5 CLOSED

Hi @cajoy. I added some tests to the suite (see commit above) trying to replicate this and was not able to. If you're able to provide more details I'll happily re-open the issue.

from cors.

Yes - you are right.

I've found the issue but don't know how to solve it.

In my app I have

// Establish our overly-permissive CORS rules.
app.use(cors({
  origin: 'http://localhost:9000',
  credentials: true
}));

// Expose a rest api
app.use(apiPath, loopback.rest());

so basically loopback.rest() overrides "Access-Control-Allow-Origin"

if I disable rest - everything is ok. If enable - it overrides.

Do you know how can I solve it?

from cors.

This do the trick:

app.set('remoting', {
    'cors': {
      origin: 'http://localhost:9000',
      credentials: true
    }
});

app.boot(__dirname);

from cors.

I had no idea any of this worked with LoopBack. :-) 👍 for figuring it out

from cors.

Ah wait, I see. Yeah, so you weren't able to use the cors library with loopback after all. Oh well. :-(

from cors.