allow frontend to read x-lago-token header #3921

mariohd · 2025-07-04T18:01:18Z

Necessary for ISSUE-978

To make the response header available on front, we need to expose him on CORS configuration.

Lines 5 to 28 in 51d309a

    
           Rails.application.config.middleware.insert_before(0, Rack::Cors) do 
        
             allow do 
        
               if ENV.key?("LAGO_FRONT_URL") 
        
                 uri = URI(ENV["LAGO_FRONT_URL"]) 
        
                 frontend_origin = if uri.port.in?([80, 443]) 
        
                   uri.host 
        
                 else 
        
                   [uri.host, uri.port].join(":") 
        
                 end 
        
                 origins frontend_origin 
        
               elsif ENV.key?("LAGO_DOMAIN") 
        
                 origins ENV["LAGO_DOMAIN"] 
        
               elsif Rails.env.development? 
        
                 origins "app.lago.dev", "api", "lago.ngrok.dev" 
        
               end 
        
               resource "*", 
        
                 headers: :any, 
        
                 methods: %i[get post put patch delete options head], 
        
                 expose: ['x-lago-token'] 
        
             end 
        
           end

This should not expose the header to any other page besides the ones listed on origins calls.

ENV["LAGO_FRONT_URL"],
ENV["LAGO_DOMAIN"],
"app.lago.dev",
"api",
"lago.ngrok.dev"

julienbourdeau

TIL

Necessary for [ISSUE-978](https://linear.app/getlago/issue/ISSUE-978/use-renewed-token-on-new-calls) To make the response header available on front, we need to expose him on CORS configuration. https://github.com/getlago/lago-api/blob/51d309a81861aa93fba9288ce97aa43ea8105c0d/config/initializers/cors.rb#L5-L28 This should not expose the header to any other page besides the ones listed on `origins` calls. ``` ENV["LAGO_FRONT_URL"], ENV["LAGO_DOMAIN"], "app.lago.dev", "api", "lago.ngrok.dev" ```

allow frontend to read x-lago-token header

0c441f1

mariohd force-pushed the fix/allow-x-lago-token branch from 51d309a to 0c441f1 Compare July 4, 2025 18:05

rsempe approved these changes Jul 4, 2025

View reviewed changes

julienbourdeau approved these changes Jul 7, 2025

View reviewed changes

mariohd merged commit 0a51599 into main Jul 7, 2025
14 checks passed

mariohd deleted the fix/allow-x-lago-token branch July 7, 2025 13:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

allow frontend to read x-lago-token header #3921

allow frontend to read x-lago-token header #3921

Uh oh!

mariohd commented Jul 4, 2025 •

edited

Loading

Uh oh!

julienbourdeau left a comment

Uh oh!

Uh oh!

Uh oh!

	Rails.application.config.middleware.insert_before(0, Rack::Cors) do
	allow do
	if ENV.key?("LAGO_FRONT_URL")
	uri = URI(ENV["LAGO_FRONT_URL"])

	frontend_origin = if uri.port.in?([80, 443])
	uri.host
	else
	[uri.host, uri.port].join(":")
	end

	origins frontend_origin
	elsif ENV.key?("LAGO_DOMAIN")
	origins ENV["LAGO_DOMAIN"]
	elsif Rails.env.development?
	origins "app.lago.dev", "api", "lago.ngrok.dev"
	end

	resource "*",
	headers: :any,
	methods: %i[get post put patch delete options head],
	expose: ['x-lago-token']
	end
	end

allow frontend to read x-lago-token header #3921

allow frontend to read x-lago-token header #3921

Uh oh!

Conversation

mariohd commented Jul 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

julienbourdeau left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mariohd commented Jul 4, 2025 •

edited

Loading