Missing Access-Control-Allow-Origin Headers on Redirects

[whizzzkid]

Checklist

• This is a bug report, not a question. Ask questions on discuss.ipfs.io.
• I have searched on the issue tracker for my bug.
• I am running the latest kubo version or have an issue updating.

Installation method

ipfs-desktop

Version

Kubo version: 0.18.1
Repo version: 13
System version: arm64/darwin
Golang version: go1.19.1

Config

{
	"API": {
		"HTTPHeaders": {
			"Access-Control-Allow-Origin": [
				"chrome-extension://imeillbedklakbfcigedogpoabljfenc",
				"http://localhost:3000",
				"https://webui.ipfs.io",
				"http://webui.ipfs.io.ipns.localhost:8081"
			]
		}
	},
	"Addresses": {
		"API": "/ip4/127.0.0.1/tcp/5001",
		"Announce": [],
		"AppendAnnounce": [],
		"Gateway": "/ip4/127.0.0.1/tcp/8081",
		"NoAnnounce": [],
		"Swarm": [
			"/ip4/0.0.0.0/tcp/4001",
			"/ip6/::/tcp/4001",
			"/ip4/0.0.0.0/udp/4001/quic",
			"/ip4/0.0.0.0/udp/4001/quic-v1",
			"/ip4/0.0.0.0/udp/4001/quic-v1/webtransport",
			"/ip6/::/udp/4001/quic",
			"/ip6/::/udp/4001/quic-v1",
			"/ip6/::/udp/4001/quic-v1/webtransport"
		]
	},
	"AutoNAT": {},
	"Bootstrap": [
		"/dnsaddr/bootstrap.libp2p.io/p2p/QmNnooDu7bfjPFoTZYxMNLWUQJyrVwtbZg5gBMjTezGAJN",
		"/dnsaddr/bootstrap.libp2p.io/p2p/QmQCU2EcMqAqQPR2i9bChDtGNJchTbq5TbXJJ16u19uLTa",
		"/dnsaddr/bootstrap.libp2p.io/p2p/QmbLHAnMoJPWSCR5Zhtx6BHJX9KiKNN6tpvbUcqanj75Nb",
		"/dnsaddr/bootstrap.libp2p.io/p2p/QmcZf59bWwK5XFi76CZX8cbJ4BhTzzA3gU1ZjYZcYW3dwt",
		"/ip4/104.131.131.82/tcp/4001/p2p/QmaCpDMGvV2BGHeYERUEnRQAwe3N8SzbUtfsmvsqQLuvuJ",
		"/ip4/104.131.131.82/udp/4001/quic/p2p/QmaCpDMGvV2BGHeYERUEnRQAwe3N8SzbUtfsmvsqQLuvuJ"
	],
	"DNS": {
		"Resolvers": {}
	},
	"Datastore": {
		"BloomFilterSize": 0,
		"GCPeriod": "1h",
		"HashOnRead": false,
		"Spec": {
			"mounts": [
				{
					"child": {
						"path": "blocks",
						"shardFunc": "/repo/flatfs/shard/v1/next-to-last/2",
						"sync": true,
						"type": "flatfs"
					},
					"mountpoint": "/blocks",
					"prefix": "flatfs.datastore",
					"type": "measure"
				},
				{
					"child": {
						"compression": "none",
						"path": "datastore",
						"type": "levelds"
					},
					"mountpoint": "/",
					"prefix": "leveldb.datastore",
					"type": "measure"
				}
			],
			"type": "mount"
		},
		"StorageGCWatermark": 90,
		"StorageMax": "10GB"
	},
	"Discovery": {
		"MDNS": {
			"Enabled": true
		}
	},
	"Experimental": {
		"AcceleratedDHTClient": false,
		"FilestoreEnabled": false,
		"GraphsyncEnabled": false,
		"Libp2pStreamMounting": false,
		"P2pHttpProxy": false,
		"StrategicProviding": false,
		"UrlstoreEnabled": false
	},
	"Gateway": {
		"APICommands": [],
		"HTTPHeaders": {
			"Access-Control-Allow-Headers": [
				"X-Requested-With",
				"Range",
				"User-Agent"
			],
			"Access-Control-Allow-Methods": [
				"GET"
			],
			"Access-Control-Allow-Origin": [
				"*"
			]
		},
		"NoDNSLink": false,
		"NoFetch": false,
		"PathPrefixes": [],
		"PublicGateways": null,
		"RootRedirect": "",
		"Writable": false
	},
	"Identity": {
		"PeerID": "12D3KooWLZZm5EMKrjBzwLKsH2kztGBZtKAJdD7H14zEAhQRjPj9"
	},
	"Internal": {},
	"Ipns": {
		"RecordLifetime": "",
		"RepublishPeriod": "",
		"ResolveCacheSize": 128
	},
	"Migration": {
		"DownloadSources": [],
		"Keep": ""
	},
	"Mounts": {
		"FuseAllowOther": false,
		"IPFS": "/ipfs",
		"IPNS": "/ipns"
	},
	"Peering": {
		"Peers": null
	},
	"Pinning": {
		"RemoteServices": {}
	},
	"Plugins": {
		"Plugins": null
	},
	"Provider": {
		"Strategy": ""
	},
	"Pubsub": {
		"DisableSigning": false,
		"Router": ""
	},
	"Reprovider": {},
	"Routing": {
		"Routers": null
	},
	"Swarm": {
		"AddrFilters": null,
		"ConnMgr": {},
		"DisableBandwidthMetrics": false,
		"DisableNatPortMap": false,
		"RelayClient": {},
		"RelayService": {},
		"ResourceMgr": {},
		"Transports": {
			"Multiplexers": {},
			"Network": {},
			"Security": {}
		}
	}
}

Description

Blocks: ipfs/ipfs-companion#1170

Issue:

• Companion checks for webui redirection for webui to link to the latest version of the webui.
• However the redirect does not supply Access-Control-Allow-Origin in the response. IIUC this is not conventional, but that's how chrome wants it.
• Paths without redirects work, so adding this header along with the redirect should fix this issue.

[BigLep]

@hacdias : can you please triage this to determine whether this is a regression or not, and put on the board if it's something we should fix soon?

[hacdias]

@BigLep afaik, @whizzzkid is using Kubo 0.18.1. Therefore, it is not a regression related to any of the current work to move the gateway to go-libipfs. I think it's an important bug as it's blocking the upgrade in IPFS Companion, but not a release-blocker.