Firebase Callable Cloud Function CORS Error

Question

The following is the client side code to call the cloud function:

var getShippingRate = firebase
            .functions()
            .httpsCallable("shippo-generateShippingRate");
          getShippingRate({ address: shippo })
            .then(function(result) {
              // Read result of the Cloud Function.
              console.log("THE SHIPPING RATES", result.data.shipment);
            })
            .catch(function(error) {
              // Getting the Error details.
              console.log("ERROR SHIPPING: ", error);
              var code = error.code;
              var message = error.message;
              var details = error.details;
            });

The cloud function:

exports.generateShippingRate = functions.https.onCall(async (data, context) => {
const customer_address = data.address;

return generateShipmentObject(customer_address);
});

generateshipmentObject returns this:

shippo.shipment.create(
{
  address_from: addressFrom,
  address_to: addressTo,
  parcels: [parcel],
  async: true
},
(err, shipment) => {
  // asynchronously called
  if (err) {
    return { error: err };
  } else {
    return { result: shipment };
  }
}

I get the standard CORS Error, but a callable Cloud Function should handle this automatically:

Access to fetch at ... from origin 'http://localhost:5000' has been blocked by CORS policy:

EDIT

I'm using firebase serve --only hosting to test on localhost.

The Cloud Functions are deployed with firebase deploy --only funtions

I'm calling other similar Cloud Functions on the same site which do not have that issue.

Answer 1

Temp fix:

In the cloud console functions page, select a function to show the info panel. In the permissions tab, select ADD MEMBER. In the new members field, type allUsers. In the roles drop down, select cloud functions, then cloud functions invoker, and save.

It actually sort of makes sense for a function to have restricted permissions when it's first created, however I'm used to the default permissions being present, so it's a bug (or new feature) that definitely threw me off. Of course this doesn't fix the underlying problem, but hope it helps.