I am using whatwg fetch in the code snippet below:
const headers = new Headers();
//uncommenting this causes the preflight options request to be sent
//headers.append('x-something', 'foo');
const response = await fetch('http://localhost:5000/api/managers', {
headers,
credentials: 'include'
});
The commented line is necessary for triggering a preflight options request:
//headers.append('x-something', 'foo');
To allow the localhost request, the server configuration includes this:
app.use(cors({
origin: 'http://localhost:4040'
}));
If I include credentials: 'include', Chrome displays an error:
Fetch API cannot load http://localhost:5000/api/managers. Credentials flag is 'true', but the 'Access-Control-Allow-Credentials' header is ''. It must be 'true' to allow credentials. Origin 'http://localhost:4040' is therefore not allowed access.
Removing credentials: 'include' and including the custom header results in an OPTIONS request with a 204 No Content response:
headers.append('x-something', 'foo');
const response = await fetch('http://localhost:5000/api/managers', {
headers
});
Simply making the code as follows displays a GET request with a JSON response:
const response = await fetch('http://localhost:5000/api/managers', {
});