We Keep Coding

Django CORS headers whitelist doesn't work

I'm working on an existing code base which consists of a Django backend and a ReactJS frontend.
Everything is dockerized so I'm running the backend on localhost:8001 and the frontend on localhost:3000.
Because I got CORS errors in the browser, I added django-cors-headers to Django. When I add CORS_ORIGIN_ALLOW_ALL = True however, I get an error saying
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at ‘http://127.0.0.1:8001/devices/’. (Reason: Credential is not supported if the CORS header ‘Access-Control-Allow-Origin’ is ‘*’).
So then I added the following settings:
CORS_ORIGIN_ALLOW_ALL = False
CORS_ORIGIN_WHITELIST = (
'http//:127.0.0.1:3000',
'http//:127.0.0.1:8001',
)
But than I get an error saying
CORS header ‘Access-Control-Allow-Origin’ missing
Why is the whitelist not working? Am I doing something wrong here?

Install any cross origin browser extension in Your browser when you run front end code locally,it will helpful.
and change the whitelist url as below (//: should be ://):
CORS_ORIGIN_WHITELIST = (
'http://127.0.0.1:3000',
'http://127.0.0.1:8001',
)

When you have CORS_ORIGIN_ALLOW_ALL = True, this will set the Access-Control-Allow-Origin: * and as the error suggests while allowing all the domains for cross-origin requests, you can't pass credentials flag with the request. So if you want to keep the header as Access-Control-Allow-Origin: *, the easiest fix would be to not use the credentials flag while sending the CORS request from the frontend.
If you want to allow only a certain domains (which is preferable), you need to find the valid domains first. Remember these domains are the originating domains from where requests are coming to Django. You can find them by looking at request.META.REMOTE_HOST. request.META is the environment seen and passed on by WSGI, and if you have some proxies in between that will give you the last host in the proxy chain.
If you have a web server that talks WSGI e.g. nginx, it will pass on the REMOTE_HOST to your Django application or to any intermediate WSGI server you have (e.g. uWSGI/gunicorn) and they will in turn pass that to your app.
Also, in your settings, the URLs in CORS_ORIGIN_WHITELIST are in wrong format; the separator between scheme and netloc is ://, not //: e.g.:
http://127.0.0.1:3000

How to enable CORS in AppRTC?

I have deployed my own apprtc server with collider & turn server configured in Google App engine locally with virtualbox. Everything is working properly but I want to use this apprtc server in my another project that is in anoter IP. So, Apprtc IP and my project IP is different. Now, when I included apprtc.debug.js & appwindow.js files to my project it cannot initialize loadingParams and says this error message "Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://<IP OF APPRTC>:8080/params. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing)".
However, entering http://<IP OF APPRTC>:8080/params in the browser gives me correct response but not in the project called in appwindow.js .After a bit of googling I added below lines in sendUrlRequest function :
xhr.setRequestHeader('Access-Control-Allow-Origin', '*');
xhr.setRequestHeader('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept');
Now it says "CORS request did not succeed".
How can I make it work? Do I have to enable cors in server side also, if so where and how to do that? Please help me, I'm totally lost here...

Flask-Mail on Google App Engine Flexible ENV

I'm trying to get Flask-Mail setup on in Flexible ENV on Google App Engine. Flask-Mail works on my localhost using the credentials for a domain I am trying to use to send the mail. However, when using it on GAE through my API it returns a 502 error, however it shows no error messages in the logs or console. Going through the documentation for GAE Flexible it doesn't mention anything about NOT being able to use it, however it doesn't show how one would setup Flask-Mail either.
I have this..
mail = Mail()
print('1') // We Get here
msg = Message("Hello",
sender="me#mydomain.com",
recipients=["me#mydomain.com"])
print('2') // We get here
msg.body = 'Testing'
print('3') // We get here
mail.send(msg)
print('4') // This never gets call because I timeout on a 502 before this
I can tell I am not getting any fatal errors because the app stays working. However this fails with the 502. I have tried adding my email to the list of authorized senders but it doesn't seem to have helped.
I would appreciate any feedback. If I forced to use a 3rd party service to send mail it may cause me to move the project off of GAE.

As Ivan posted on his comment, to send email from a GAE app you need to use a mail service. Right now there are 3 options for apps on a flexible environment: Mailgun, MailJet and SendGrid. Choose the one you see better for your app.
After setting up an account on the mail service you have chosen, you have to prepare your code by integrating the parts related to the mail service.
These tutorials should help you establish the mail service for your app:
Mailgun
MailJet
SendGrid

I've had the same error but on a virtual machine on the internet ( linode service ) and it turned out that it has some thing to do with rDNS and some domain name config that you have to set up for your Ip address to get things working correctly , check this
https://www.linode.com/community/questions/19082/i-just-created-my-first-linode-and-i-cant-send-emails-why

Using https as standard with django project

I am learning django and trying to complete my first webapp.
I am using shopify api & boilder plate (starter code) and am having an issue with the final step of auth.
Specifically, the redirect URL -- it's using HTTP:// when it should NOT and I don't know how to change it..
#in my view
def authenticate(request):
shop = request.GET.get('shop')
print('shop:', shop)
if shop:
scope = settings.SHOPIFY_API_SCOPE
redirect_uri = request.build_absolute_uri(reverse('shopify_app_finalize')) #try this with new store url?
print('redirect url', redirect_uri) # this equals http://myherokuapp.com/login/finalize/
permission_url = shopify.Session(shop.strip()).create_permission_url(scope, redirect_uri)
return redirect(permission_url)
return redirect(_return_address(request))
Which is a problem because my app uses the Embedded Shopify SDK which causes this error to occur at the point of this request
Refused to frame 'http://my.herokuapp.com/' because it violates the following Content Security Policy directive: "child-src 'self' https://* shopify-pos://*". Note that 'frame-src' was not explicitly set, so 'child-src' is used as a fallback.
How do i change the URL to use HTTPS?
Thank you so much in advance. Please let me know if I can share any other details but my code is practically identical to that starter code

This is what the Django doc says about build_absolute_uri:
Mixing HTTP and HTTPS on the same site is discouraged, therefore
build_absolute_uri() will always generate an absolute URI with the
same scheme the current request has. If you need to redirect users to
HTTPS, it’s best to let your Web server redirect all HTTP traffic to
HTTPS.
So you can do two things:
Make sure your site runs entirely on HTTPS (preferred option): Setup your web server to use HTTPS, see the Heroku documentation on how to do this. Django will automatically use HTTPS for request.build_absolute_uri if the incoming request is on HTTPS.
I'm not sure what gets passed in the shop parameter but if it contains personal data I'd suggest to use HTTPS anyway.
Create the URL yourself:
url = "https://{host}{path}".format(
host = request.get_host(),
path = reverse('shopify_app_finalize'))
But you will still need to configure your server to accept incoming HTTPS requests.

Redirect uri error when aunthenticating with VK.com

I am trying to develop login with vk.com feature for our website. And testing it locally. In app I have given
http://127.0.0.1/
as base domain. In website during authorization it is requesting url:
https://oauth.vk.com/authorize?client_id=XXXX&redirect_uri=http://127.0.0.1/vk/login/check/&state=trackid=XXXX..
In callback url, I am calling
https://oauth.vk.com/access_token?client_id=XXXX&client_secret=YYYY&redirect_uri=redirect_uri=http://127.0.0.1/vk/login/check/aaa/bbbb&code=
But its not loading VK website for logging in. It shows error
{"error":"invalid_request","error_description":"redirect_uri has wrong
domain, check application settings"}.
Dont know whats wrong. Any help?
Earlier when testing to request code and accesstoken manually, I had given domain in app as https://www.example.com and used https://www.example.com as redirect url when requesting code and access token. At that time it had worked.
Now how can I test it when our website is running locally? Please help

You should open your 8000 port and put to "redirect_uri" your ip. But it's not exactly work, because u should have your own host

go to your app setting in VK set your redirect-uri http://127.0.0.1:5000/anything (port is important/use Port that you are using according to server hosting service). then try it.