CORS - Cross-Origin Request Blocked

[pjworrall]

Hi

I have a local Inrupt ESS eval install. I have cloned, built and run up a local node server running the PodBrowser on http://localhost:3000 . When I refer to my local IdP for the Log In I get a Cross-Origin Request Blocked. I am not surprised as we are going http to https: the ESS install has self signed certs and a browser exception.

Is this an oversight in the instructions?

Is there a way of running the local node server with the PodBrowser on https?

[ajacksified]

Hi @pjworrall,

You should be running PodBrowser on https. By default, running npm run dev should run server.js, which runs the server in https mode. What command are you using to run PodBrowser?

If you are using npm start, that appears to be an oversight in the instructions- you're intended to either deploy to vercel, or put this behind a proxy which serves the statically built files over https (otherwise you'll be serving the default self-signed PodBrowser cert.)

If you'd like to use the node server rather than the statically built files, let me know and I can take a look at making the certificate location configurable for production.

[pjworrall]

yes I had done npm run start . I had done the npm install and gone straight to deploy. I wasn't comfortable deploying anything to Vercel because I didn't know what it was and did not know what the policy implications would be for pushing code from our environment to it.

The first alternative was the npm run start . Hence, that is how I bumped into the problem.

fyi there was no .env-example local variable file, just an empty .env.development, and, having run into that, I might have not been that conscious of having a go at npm run dev. Which was the next line in the installation section instructions

[ThisIsMissEm]

Running on localhost:3000 without https should now work in browsers, without the need for a custom SSL certificate like that which we have in Pod Browser, there has been previous work to actually remove that in #440 — but for now, PodBrowser still expects to be accessed via https.