storybookjs/storybook

Refs to other localhosts do not work

Open

#18,405 opened on Jun 4, 2022

View on GitHub
 (12 comments) (9 reactions) (0 assignees)TypeScript (89,909 stars) (10,058 forks)batch import
bugcompositionhas workaroundhelp wantedsev:S3

Description

Bug:

Access to fetch at 'http://localhost:3000/stories.json' from origin 'http://localhost:3020' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

You can not use the wildcard * when the credentials mode is true. At the moment it is not set so I think chrome is placing:

Access-Control-Allow-Credentials: true

by default. I think when this is set to:

Access-Control-Allow-Credentials: false

it should work.

Contributor guide

Tech stack
typescriptnodejs
Domain
backendsecurity
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
CORS knowledgeStorybook configuration
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
80
Research direction
Look into the Storybook dev server's CORS settings, likely in the `@storybook/core server` package. Check the server's response headers and the `access control allow credentials` setting. Consider modifying the default behavior to not send credentials mode when using wildcard origin, or to set `Access Control Allow Credentials: false` by default. Review the issue comments for any additional context from maintainers.