Firebase HTTP function CORS

Question

I'm still having problems with CORS when using Firebase HTTP functions.

Here is my web console error:

Response to preflight request doesn't pass access control check: No 
'Access-Control-Allow-Origin' header is present on the requested resource. 
Origin 'http://localhost:3000' is therefore not allowed access. The 
response had HTTP status code 404.

Here is my function:

const cors = require('cors')({ origin: true });
const express = require('express');
const functions = require('firebase-functions');

const app = express();
const validate_user = require('./validate_user_id_token.js');
const charge_card = async(req, res) => {
  // ...
}

app.use(cors);
app.use(validate_user);
app.use(charge_card);

exports.foo = functions.https.onRequest(app);

I think I've read over every single Firebse CORS question. I also have a near replica of the sample provided here.

Please help :)

Edit: The URL I am calling is correct (used texdiff.com just to be sure, and functions logs are showing it as executed but returning 404). For reasons unknown, a 404 is returned regardless. Perhaps that is CORS mechanism?

Update: I got things working without using express by putting using cors() in my onRequest handler:

exports = module.exports = functions.https.onRequest(async(req, res) => {
    cors(req, res, () => {});
    await charge_card(req, res);
});

Not ideal, but it works for now :/

Answer 1

According to the Firebase documentation, there are a couple of references to CORS configuration:

Using CORS:

You can enable the use of CORS by calling it within the function, just like you did in your update to the question:

// Usage of the `cors` express middleware
return cors(req, res, () => {
  // TO-DO
});

Also if you have an already existing Express app, you can then enable CORS by doing:

const app = express();
app.use(cors({ origin: true }));

This is what you had already done on the first step, but there's the difference in the { origin: true } definition, so maybe that is related.

In any case, as per the documentation it looks like it is indeed fine to add the cors within the request.