Can't figure out "No 'Access-Control-Allow-Origin' header" in Node Express with CORS and Mandrill

Question

I've been reading up enough to know I'm lost on this one. The solutions on other threads don't seem to help.

I have a page at pages.samedomain.com calling the mandrill api in my Node site at apps.samedomain.com. Using ORM, I am able to write through the tables route just fine. After the table is written and the page receives confirmation, it's supposed to fire to the email route. When run locally, both work fine. When deployed, I get...

XMLHttpRequest cannot load http://apps.samedomain.com/.../.../mail/4847775376401843. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://pages.samedomain.com' is therefore not allowed access. The response had HTTP status code 502.

In my app.js I have...

var cors = require('cors');
app.use(cors());

In my routes file I have...

module.exports = function(appRouter) {    

var mandrill = require('mandrill-api/mandrill');
var mandrill_client = new mandrill.Mandrill(process.env.MANDRILL_API_KEY);    

appRouter.route('/.../mail/:first_list_id').post(function(req,res){

    req.models.know_me_2016
        .find({list_id:req.params.first_list_id})
        .run(function(err, results){
            if (err) { 
                res.send(err); 
            } else {
                var template_content = [{
                    "recipient": <stuff> ,
                    "content": <stuff>
                }];
                var message = {
                    <mandrill message object stuff>
                };
            }

            mandrill_client.messages.sendTemplate({
                "template_name": <template-name>, 
                "template_content": template_content, 
                "message": message}, function(result) {
                    console.log(result);

                    //I tried adding header stuff but it didn't help, maybe in wrong place? I thought CORS library was going to take care of this part?

                    res.header("Access-Control-Allow-Origin", "http://interactives.dallasnews.com");
                    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");

                    //It sends successfully when run local
                    res.send("Email sent successfully");
                }, function(e) {
                    // Mandrill returns the error as an object with name and message keys
                    console.log('A mandrill error occurred: ' + e.name + ' - ' + e.message);
                    // A mandrill error occurred: Unknown_Subaccount - No subaccount exists with the id 'customer-123'
            });
        });        
    });
}

My Mandrill key is set to accept all IPs.

Any insight would be appreciated.

sub domain is considered a different domain. – epascarello Feb 02 '16 at 17:47 — epascarello, Feb 02 '16 at 17:47

Ben · Answer 1 · 2016-02-02T19:04:51.717

0

You need to add allowed origins to the white list when initializing cors:

var whitelist = [
    'http://samedomain.com',
    'http://apps.samedomain.com',
    'http://pages.samedomain.com'
    // list whatever possible domains you have
]
var globalCorsOptions = {
    origin: function(origin, callback) {             
        callback(null, whitelist.indexOf(origin) !== -1);
    }
};

var cors = require('cors');
app.use(cors(globalCorsOptions));

edited Feb 02 '16 at 19:04

answered Feb 02 '16 at 18:59

Ben

5,024
2
18
23

I see what you're doing here. I still get the same error, however. Any suggestions on where to look next? I'll run down the whitelist rabbit hole and see what I find. Thanks. – Layne Feb 02 '16 at 19:27
I notice in the CORS documentation they use "cors(corsOptions)" in with the route. Example: app.get('/products/:id', cors(corsOptions), function(req, res, next){ ... }); Do I need to incorporate that in my route somewhere? – Layne Feb 02 '16 at 19:50
If you want to have it for a specific route, then do that. Otherwise, app.use(cors(corsOptions)) applies to all routes. – Ben Feb 02 '16 at 20:43
Checking headers in Chrome... from the route that adds a table via orm I see "Access-Control-Allow-Origin: ". However, the request to the email route is red in the network tab and there is no "Access-Control-Allow-Origin: " which makes sense since the 502 Bad Gateway error says the same thing. But I'm scratching my head over the difference between one and the other. – Layne Feb 02 '16 at 20:59

score 0 · Answer 2 · answered Feb 03 '16 at 19:18

In this particular case, it turns out the problem was with the lack of an updated .env file. Our private git ignores .env files so the credentials weren't being posted. Mandrill was unable to connect. Once the Mandrill credentials were inserted and the .env remote updated, it started working as expected.

Can't figure out "No 'Access-Control-Allow-Origin' header" in Node Express with CORS and Mandrill

2 Answers2