New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Uvicorn / fastAPI rewrites URLs from https to http, which breaks CORS #43

Open

Lytigas opened this issue Jan 14, 2020 · 0 comments

Member

Lytigas commented Jan 14, 2020 •

edited

Loading

For normal functionality, this is still a problem:

Request https://host/endpoint
FastAPI canonicalizes the endpoint: Redirect to http://host/endpoint/
AWS ELB sees a request on 80 and redirects to 443: Redirect to https://host/endpoint/
FastAPI responds: Receive response

Step 2 breaks CORs, in a secure context, and also could leak data if form data is sent before the redirect.

In apps we write ourselves, we can workaround this issue by remembering to pre-canonicalize our URLs, but it'd be nice to not have to worry.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment