Intra-App routing not working

[mikkelhegn]

The following method of calling a route within a Spin app written in JS/TS does not work: https://developer.fermyon.com/spin/v2/http-outbound#intra-application-http-requests-by-route

It looks like the call is using the host-name that spin up is binding to - e.g., http://localhost:3001, which causes the following error, even with having allowed_outbound_hosts = ["http://self", "https://self"] in spin.toml

const response = await fetch("/back");

2024-12-09T08:40:17.797984Z ERROR spin_runtime_factors: Outbound network destination not allowed: http://localhost:3001
Warning: A component tried to make an outbound network connection to disallowed destination 'http://localhost:3001'.
To allow this request, add 'allowed_outbound_hosts = ["http://localhost:3001"]' to the manifest component section.

[radu-matei]

Validating that this is still an issue for the V3 SDK.

[karthik2804]

This is due to the way the fetch API spec is defined. This is something that needs to be addressed in Spin. This is due to fetch API always converting URLs without a host to a relative URL and Spin expecting to use self routing only for requests that do not have a host.

[radu-matei]

This is currently a blocker for building multi-component applications in JS.

We need to document how users can work around this -- i.e. by using the full URL header. Or by implementing local service chaining.

[karthik2804]

@radu-matei, there is an open workaround in Spin - spinframework/spin#3003 and discussion there would be great.

[karthik2804]

Also, the full URL workaround is not pretty because then the user would have to know the URL of the deployed app before writing the application to allow list it in the manifest which would also mean that the application can not be easily moved around.

[itowlson]

@radu-matei The spinframework/spin#3003 fix is blocked on a review, but otherwise I believe it's ready to go.

[karthik2804]

This is fixed with v3.2 and can now be used as follows:

let res = await fetch("http://self.alt/api")

We will still need to document it though so leaving it open until we document it.