Avoid the CORS preflight on patch artifact reads
Maintainers usually reply within 3 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- google-cloud, javascript
- Domain
- api, cloud, frontend, networking
Research direction
Start with the patch panel from #6856, the /api/runs/:runId/artifacts/*path route, and the tracePropagationTargets configuration. Compare the inline proxy and excluded-trace-propagation approaches, including their effects on signed downloads, CORS, and tracing. Done means patch reads no longer incur the avoidable preflight while the selected behavior remains functional locally and with GCS.
Written by the indexing model from the issue text.
Description
The patch panel (#6856) reads changes/changes.patch with fetch() against /api/runs/:runId/artifacts/*path, which 302s to a signed GCS URL.
The Sentry browser SDK adds sentry-trace and baggage to that fetch, since the URL is same-origin when the headers are decided. The browser then replays them across the redirect, so the cross-origin leg to GCS carries two non-safelisted headers and must be preflighted. GCS builds Access-Control-Allow-Headers from the bucket's CORS responseHeader list, so until those names were listed the preflight returned 200 with no
access-control-* headers and the read failed.
Unblocked for now by allowing OPTIONS in the bucket's CORS method list and adding sentry-trace and baggage to responseHeader. Worth revisiting:
- Every patch load costs an OPTIONS plus the GET, on top of our own 302. The preflight cache never helps because each load gets a freshly signed URL.
- GCS ignores
sentry-trace, so we send trace metadata to Google and get no trace continuity for it. - Infra config now hardcodes SDK header names; a new propagation header would break the panel again as an opaque CORS error.
Possible fixes:
- Add an inline mode to the artifact route that proxies the preview bytes same-origin, keeping the 302 for download links. No CORS, no preflight, works locally, keeps browser-to-server trace linkage. Bytes transit Cloud Run, bounded by a read cap (I would avoid this solution).
- Exclude the artifact path from trace propagation:
tracePropagationTargets: [/^\/(?!api\/runs\/[^/]+\/artifacts\/)/]. Drops the preflight, but loses trace linkage for that route and still needs
bucket CORS for the GET.
- Dominant language
- Python
- Stars
- 570
- Forks
- 351
- Avg merge
- 2d 1h
- Merged PRs (30d)
- 72
Getting set up
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from mozilla/bugbug
-
hackbot
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 3 days
-
hackbot
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 3 days
-
good-first-bug hackbot
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 3 days
-
hackbot
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
mozilla/bugbug#6919 · 1 comment ·
Maintainers usually reply within 3 days
-
good-first-bug hackbot
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
mozilla/bugbug#6918 · 5 comments ·
Maintainers usually reply within 3 days
Similar issues
-
good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
vllm-project/vllm-metal#822 ·
Maintainers usually reply within 1 day
-
vector-store
Difficulty 1/5 1-3 hours Newbie friendliness 90/100
mem0ai/mem0#7461 · 1 comment ·
Maintainers usually reply within 1 day
-
[Bug]: chunk_span_bounds and _validated_chunk_spans reject Pydantic models ChunkSpan and AudioFileOpen
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
BasedHardware/omi#19047 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Maintainers usually reply within 1 day