Workers Auto Approve
Parity rejects MetaMask's `x-metamask-origin` header, and consequently all MetaMask/Firefox requests, during CORS preflight
parity, paritytech, Rust, Shell, C++, Swift, NSIS, C
- **Parity version**: 1.6.10
- **Operating system**: Linux
- **And installed**: via `parity/parity:stable` Docker image
When using MetaMask 3.10.8 on Firefox 55 on Windows 7, pointed at my Parity node running on another Ubuntu machine, I observe an HTTP exchange that goeth thusly:
OPTIONS / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept-Encoding: gzip, deflate
HTTP/1.1 200 OK
Allow: OPTIONS, POST
Access-Control-Allow-Headers: origin, content-type, accept
Date: Mon, 02 Oct 2017 00:58:04 GMT
This is a CORS preflight for an actual request, but the actual request is never sent.
MetaMask wants to send an `x-metamask-origin` header with its request, giving the actual page (as opposed to `moz-extension://c2480724-8a32-4afc-a7aa-c1d18a8bf229`) that it is proxying requests for. Presumably this is so that you could potentially configure your node to handle requests only for certain duly authorized actual page origins, even when using MetaMask.
Parity doesn't seem to know about this header, and in particular is not returning it in the `Access-Control-Allow-Headers`. According to the CORS spec, that means that the browser must not permit a request to be made with that header on it. MetaMask (on Firefox, at least) insists on trying to send the header, so Firefox blocks its request altogether. The net result of all this is that MetaMask on Firefox does not work with a Parity node as the backend.
For maximum compatibility, Parity should echo back all the headers from `Access-Control-Request-Headers` in `Access-Control-Allow-Headers`. There could be a blacklist of headers that web pages should be prohibited from sending, but I don't think Parity trusts the RPC headers at all anyway, so I can't think of a reason not to just let pages send whatever they want.
This is related to https://github.com/MetaMask/metamask-extension/issues/1779. It can be fixed in MetaMask with https://github.com/MetaMask/metamask-extension/pull/2250 to have MetaMask not send the header, or https://github.com/MetaMask/metamask-extension/pull/2138 to just ignore/skip the CORS preflight (as long as the Parity instance you are using is running on one of the domains mentioned in the MetaMask manifest). However, Parity should also fix it; you never know what `x-` headers a client is going to want to send.
Setup your profile
Tell us a little about you:
No results found for
Type to search skills..
Required [[totalcharacter]] / 240
Are you currently looking for work?
[[ option.string ]]
Setup your profile
Our tools are based on the principles of earn (💰), learn (📖), and meet (💬).
Select the ones you are interested in. You can change it later in your settings.
I'm also an organization manager looking for a great community.
Enable your organization profile
Gitcoin products can help grow community around your brand. Create your tribe, events, and incentivize your community with bounties. Announce new and upcoming events using townsquare. Find top-quality hackers and fund them to work with you on a grant.
These are the organizations you own. If you don't see your organization here please be sure that information is public on your GitHub profile. Gitcoin will sync this information for you.
Select the products you are interested in:
Out of the box you will receive Tribes Lite for your organization. Please provide us with a contact email: