Appwrite/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite.git synced 2026-05-26 13:51:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: resolve cors safely in error handler to avoid cascading failures

Browse Source 
- Remove cors from inject chain; resolve via getResource() inside
  try-catch so DB failures don't cascade when resolving the cors
  resource dependency chain (cors -> allowedHostnames -> rule -> DB)
- Use override:true on addHeader to prevent duplicate CORS headers
  when init() already set them before the exception was thrown
- Degrades gracefully: if cors resolution fails, error response is
  sent without CORS headers (same behavior as before this PR)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Damodar Lohani
2026-04-06 02:59:08 +00:00
parent 44f3bbae03
commit ba25849871
1 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/general.php
+12 -4
View File
@@ -1196,8 +1196,7 @@ Http::error()
->inject('bus')
->inject('devKey')
->inject('authorization')
->inject('cors')
->action(function (Throwable $error, Http $utopia, Request $request, Response $response, Document $project, ?Logger $logger, Log $log, Bus $bus, Document $devKey, Authorization $authorization, Cors $cors) {
->action(function (Throwable $error, Http $utopia, Request $request, Response $response, Document $project, ?Logger $logger, Log $log, Bus $bus, Document $devKey, Authorization $authorization) {
$trace = $error->getTrace();
foreach (array_slice($trace, 0, 100) as $index => $traceEntry) {
@@ -1494,8 +1493,17 @@ Http::error()
'type' => $type,
];
foreach ($cors->headers($request->getOrigin()) as $name => $value) {
$response->addHeader($name, $value);
// Add CORS headers to error responses so browsers can read the error.
// Wrapped in try-catch: if the error itself is a DB failure, resolving
// the cors resource (which depends on rule -> DB) would cascade.
// Uses override:true to avoid duplicate headers if init() already set them.
try {
$cors = $utopia->getResource('cors');
foreach ($cors->headers($request->getOrigin()) as $name => $value) {
$response->addHeader($name, $value, override: true);
}
} catch (Throwable) {
// Degrade gracefully - error response without CORS is no worse than before.
}
$response