I've created a web service with Drupal 8 REST to accept POST requests for creating player score entities.

The service works great when tested with POSTMAN and DHC.

I'm now attempting to POST a request from HTML5 (web browser game) and getting the following error:

Symfony\Component\HttpKernel\Exception\UnsupportedMediaTypeHttpException: No route found that matches the Content-Type header. in Drupal\Core\Routing\ContentTypeHeaderMatcher->filter() (line 50 of /var/www/html/nobody/core/lib/Drupal/Core/Routing/ContentTypeHeaderMatcher.php).

After some research I believe the issue is CORS related. I proceeded to install CORS 8.x-1.0, but I am unsure of what entry(s) to make on admin/config/services/cors. The relative endpoint is entity/score. What's the syntax for allowing cross-domain POSTs? I have mod_headers enabled.

Comments

bacteriaman created an issue. See original summary.

clemens.tolboom’s picture

clemens.tolboom
Primary language Dutch
Location Groningen, 🇳🇱/🇪🇺
commented
Related issues: +#2237231: Support OPTIONS request

You need core patch #2237231: Support OPTIONS request in first.

johnhanley’s picture

johnhanley commented

@clemens.tolboom, thanks for your reply.

Am I to presume the current CORS install base of 2,481 have applied the aforementioned patch?

It seems weird this requirement this isn't documented on the project page.

In any event, it looks like the issue contributors are getting close to including the patch in an upcoming point release. My project isn't time sensitive.

clemens.tolboom’s picture

clemens.tolboom
Primary language Dutch
Location Groningen, 🇳🇱/🇪🇺
commented

I'm not sure but there are only 38 https://www.drupal.org/project/usage/2665614

Mentioned issue summary #2237231: Support OPTIONS request state it's needed preflight for CORS.

johnhanley’s picture

johnhanley commented

Awe, good call. Thanks for the clarification.

In that case I will proceed to apply the patch. I'm anxious to see my score posting system working from end to end.

clemens.tolboom’s picture

clemens.tolboom
Primary language Dutch
Location Groningen, 🇳🇱/🇪🇺
commented

@bacteriaman guess you were right as testing with or without core patch I cannot tell whether it matters.

From a remote web site http://drupal.d7 I do get in both cases

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://drupal.d8/user/3?_format=json. (Reason: CORS preflight channel did not succeed).

but anonymous is not allowed to view users. Guess that's ok.

Obvious running without core patch gives

curl --request OPTIONS "http://drupal.d8/user/1?_format=json"
{"message":"No route found for \u0022OPTIONS \/user\/1\u0022: Method Not Allowed (Allow: GET, POST, DELETE)"}%

(me puzzled)

johnhanley’s picture

johnhanley commented

I was able to successfully apply the patch to 8.1.0-dev, but now CORS isn't enabled and attempting to enable it produces the following error in the system log:

ReflectionException: Class Drupal\Core\EventSubscriber\OptionsRequestSubscriber does not exist in ReflectionClass->__construct() (line 30 of /var/www/html/nobody/core/lib/Drupal/Core/DependencyInjection/Compiler/RegisterEventSubscribersPass.php).

Perhaps this is caused by updating core from drupal-8.0.5 to 8.1.0-dev.

@clemens.tolboom, I know you're one of the patch contributors and I appreciate your efforts in this endeavor. I'm not sure what to try next at this point. Please let me know when you have something ready for testing. I have a vested interest in seeing this work.

clemens.tolboom’s picture

clemens.tolboom
Primary language Dutch
Location Groningen, 🇳🇱/🇪🇺
commented

@bacteriaman I've seen similar exception when uninstall CORS module.

My app works with patch on 8.1.x + CORS module.

johnhanley’s picture

johnhanley commented

@clemens.tolboom, I will give it another go and report back. Thanks for your help!

johnhanley’s picture

johnhanley commented

I'm revisiting this issue after a couple months hiatus.

I'm now running Drupal 8.1.1, but am still unable to POST to my RESTful web service from my HTML5 game. However it works when the game is compiled as a Windows executable. I am also able to POST from DHC Chrome Extension. I'm using Basic Authentication.

I suspect CORS is not configured correctly. What CORS configuration entries are required to enable POSTs from HTML5 from a specific domain?

And is the aforementioned patch still required?

sachbearbeiter’s picture

sachbearbeiter commented

I'm trying to use this module together with D8.1 without success.
I'm delivering JSON via a view and try to consume it from another domain.
In Firebug i still get: CORS-Header 'Access-Control-Allow-Origin' is missing.
Do i understand something totally wrong? Or do i still need the patch?

johnhanley’s picture

johnhanley commented

@achbearbeiter, I feel your pain. :-)

I too am still looking for a solution to successfully POST cross-domain.

I haven't had time to revisit the issue, but I will let you know if/when I have a breakthrough. Please do the same.

John

sachbearbeiter’s picture

sachbearbeiter commented

OK :)

sachbearbeiter’s picture

sachbearbeiter commented

Has someone an idea here? A custom module for example ...

Thanks
SB

justafish’s picture

justafish
she/her
Primary language English
Location London, UK
commented
Status: Active » Closed (won't fix)