Receiving CORS error when request URL becomes too long

[JPStrydom]

Steps to reproduce

I have a feathers API with a MongoDB behind it and an Angular website, all running in a Docker container. All functioned normally until I recently started receiving CORS errors on some of my requests. I realised that the only difference between failing requests and successful ones is their length. The base request works and certain queries work separately, but as soon as I have all the queries in one request I receive a CORS error. A request of character length 485 works fine, but one of length 625 gives a CORS error. So at some length in between those it must be failing

Expected behavior

My request should return the data I'm querying.

Actual behavior

I receive the following error:

Access to XMLHttpRequest at 'REQUEST' from origin 'FRONT-END' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

System configuration

Module versions (especially the part that's not working): My package.json contains the following relevant feathers packages:

...
"dependencies": {
    "@feathersjs/authentication": "^2.1.7",
    "@feathersjs/authentication-jwt": "^2.0.1",
    "@feathersjs/configuration": "^1.0.2",
    "@feathersjs/errors": "^3.3.0",
    "@feathersjs/express": "^1.2.3",
    "@feathersjs/feathers": "^3.1.7",
    "@feathersjs/socketio": "^3.2.2",
    "feathers-hooks-common": "^4.15.0",
    "feathers-logger": "^0.2.3",
    "feathers-memory": "^2.1.3",
    "feathers-mongodb": "^2.9.1",
    "feathers-mongodb-fuzzy-search": "^1.1.1",
    "feathers-mongoose": "^5.1.2",
    "feathers-populate-hook": "^0.2.3",
    "feathers-swagger": "^1.1.0",
    ...
  },
  ...

NodeJS version: 10.15.3

Operating System: Windows 10 Pro (10.0.18363 (64-bit))

Browser Version: Tested on latest Chrome (Version 81.0.4044.113 (64-bit)) and Opera (Version:65.0.3467.78 (64-bit)) browser

[daffl]

This might be a restriction in Express or the cors module. Another possible issue could be the query string array limit.

[JPStrydom]

This might be a restriction in Express or the cors module. Another possible issue could be the query string array limit.

I'll give this a shot, thanks!

[ScooterDelta]

Thanks for the help @daffl. We found the issue afterall, it wasn't to do with Feathers.js directly, but was rather due to the Node HTTP_MAX_HEADER_SIZE:

• When http header size limit is reached, instead of a generic 400 response, return 431 Request Header Fields Too Large nodejs/node#25528
• Max header size of 8KB is a breaking change nodejs/node#24731
• Increase HTTP_MAX_HEADER_SIZE to 16kb nodejs/node#27645

[daffl]

This is good to know, thanks for sharing!