Very odd CORS issue with file uploads

[alex-r89]

Hi there,

I am running into a very odd issue related to uploading files. For some reason, uploading a specific gif is causing a CORS error; No 'Access-Control-Allow-Origin' header is present on the requested resource..

The reason this is odd is because it is only that specific file. All other files (of the same and different type) that I have tested (50 test file uploads or so) are uploading perfectly.

I am using apollo-server-express (2.19) on my back end along side createUploadLink from apollo-upload-client (14.1.2) on the front end.

As stated, this error is only occurring with a single specific file - all other file uploads have worked perfectly.

I was wondering if anyone has any idea as to why this may be?

If its any consolation, this is the request/response headers for a fail and success upload

Fail upload request/response headers

accept: */*
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Connection: keep-alive
Content-Length: 1288211
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryz1xLosAlu9elKywL
Cookie: qid=s%3AOAV8AgO8qb1Q8Irv0B3HfcoPwuA5sG2H.CmteVCjlqVWboShAyrBqhL6qaEWpwh2n%2BI7ly0GhVmo
Host: api.mydomain.net
Origin: https://mydomain.net
Referer: https://mydomain.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36

Connection: close
Content-Length: 610
Content-Type: text/html
Date: Sat, 21 Nov 2020 23:58:26 GMT
Server: nginx/1.14.0 (Ubuntu)

Success upload request/response headers

accept: */*
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Connection: keep-alive
Content-Length: 965380
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryG3YJX9g4rEhktUbU
Cookie: qid=s%3AOAV8AgO8qb1Q8Irv0B3HfcoPwuA5sG2H.CmteVCjlqVWboShAyrBqhL6qaEWpwh2n%2BI7ly0GhVmo
Host: api.mydomain.net
Origin: https://mydomain.net
Referer: https://mydomain.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://mydomain.net
Connection: keep-alive
Content-Length: 157
Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Content-Type: application/json; charset=utf-8
Date: Sun, 22 Nov 2020 00:10:41 GMT
ETag: W/"9d-JzDHnclZVXpxHFM7kd1zxzNIy+Y"
Expect-CT: max-age=0
Referrer-Policy: no-referrer
Server: nginx/1.14.0 (Ubuntu)
Strict-Transport-Security: max-age=15552000; includeSubDomains
Vary: Origin
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-XSS-Protection: 0

[devdudeio]

are you may using node 14 now? try to use node 12. In my case the cors issue was just a side effect because the upload was failing and was throwing an exception, so its tricked our load balancers with a 500 server error, which results in a cors issue for the browsers prefilight requests. Or the file is maybe just throwing an error while uploading.

https://stackoverflow.com/questions/59620803/createreadstream-throwing-rangeerror-maximum-call-stack-size-exceeded-when-up