Repository navigation
Answer CORS preflight OPTIONS on the enquiry endpoint - #562
Merged
Merged
Conversation
Browsers send a preflight OPTIONS request before any cross-origin POST with a Content-Type of application/json. json_request_middleware tried to JSON-parse the empty OPTIONS body and returned a 400, so the preflight failed and the browser never sent the enquiry POST — the tutorcruncher.com contact form has been unable to submit because of this. Skip body parsing for OPTIONS and have the enquiry view answer it with 204 plus the Access-Control-Allow-* headers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
tejas7777
commented
Sep 1, 2026
|
|
||
| - name: set up python | ||
| uses: actions/setup-python@v1 | ||
| uses: actions/setup-python@v5 |
Contributor
Author
There was a problem hiding this comment.
Outdated test runner
…tributes The test set extra_attributes='default', which makes the tell-us-about-yourself attribute required, but posted no attributes, so the enquiry was rejected with a 400 instead of the asserted 201. It merged unnoticed because CI's setup-python step was already broken and tests never ran. The test only cares that a long grecaptcha token passes validation, so drop the extra_attributes line. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
tejas7777
commented
Sep 1, 2026
|
|
||
|
|
||
| async def test_post_enquiry_long_grecaptcha_response(cli, company, other_server, worker): | ||
| other_server.app['extra_attributes'] = 'default' |
Contributor
Author
There was a problem hiding this comment.
Claude Says: this line made the options define a required attribute (tell-us-about-yourself) that the posted data never included, so the test could only ever get a 400 — it merged green because CI's setup-python step was broken and tests never ran. The test only checks that a long grecaptcha token passes validation, so the attribute setup is dropped.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Technical description of changes
The tutorcruncher.com contact form cannot submit: it posts to
/{company}/enquirywithContent-Type: application/json, so the browser first sends a CORS preflight OPTIONS request.json_request_middlewaretreats every non-GET/HEAD method as a JSON request, tries to parse the empty OPTIONS body, and returns 400 ("Value Error: Expecting value: line 1 column 1 (char 0)"), so the preflight fails and the browser never sends the POST. Reproducible withcurl -X OPTIONS https://socket.tutorcruncher.com/<key>/enquiry.Changes:
json_request_middlewareskips body parsing for OPTIONS.enquiryview (registered withadd_route('*', ...)) answers OPTIONS with 204 andAccess-Control-Allow-Origin/Methods/Headersso the preflight succeeds.The embedded widget (socket-frontend) is unaffected either way — its XHR never sets Content-Type, so its posts are simple requests with no preflight.