Access-Control-Allow-Origin is not working when streaming the data

[iserioton]

Prerequisites

• I have written a descriptive issue title
• I have searched existing issues to ensure the bug has not already been reported

Fastify version

8.2.0

Plugin version

No response

Node.js version

18.16.1

Operating system

Windows

Operating system version (i.e. 20.04, 11.3, 10)

Window 10

Description

I set up the cors like this: server.register(cors, { origin: '*', });

It works for normal APIs, but when I stream the data, it does not work.
const stream = fs.createReadStream(filePath); reply.type('application/json').header('Content-Length', fs.statSync(filePath).size); return stream.pipe(reply.raw);

Steps to Reproduce

Follow the description!

Expected Behavior

It should set "Access-Control-Allow-Origin" to "*" for the response header!

[Uzlopak]

See the test i added to the PR #260 on how to do it correct.

[VityaSchel]

Any workaround?

upd: Use custom preHandler hook:

fastify.addHook('preHandler', corsPreHandler)

export const corsPreHandler = (req: FastifyRequest, res: FastifyReply, done: HookHandlerDoneFunction) => {

  const blacklistedPaths = ['/page/:pageParam']
  if (!blacklistedPaths.includes(req.routerPath)) {
    const origin = req.headers.origin ?? ''
    res.header('Access-Control-Allow-Origin', origin)
    res.header('Access-Control-Allow-Methods', '*')
    res.header('Access-Control-Allow-Headers', '*')
  }

  const isPreflight = /options/i.test(req.method)
  if (isPreflight) {
    return res.send()
  }
      
  done()
}

taken from SO

[Uzlopak]

Why cant you use reply.send(stream)?

[mcollina]

stream.pipe(reply.raw) bypasses all Fastify logic by using reply.raw. Use return stream in your route or reply.send(stream)

[iserioton]

Also worked when I did this:

reply
  .type("application/json")
  .header("Access-Control-Allow-Origin", "*")
  .header("Content-Length", fs.statSync(filePath).size);
reply.raw.writeHead(200, reply.getHeaders());
return stream.pipe(reply.raw);

[climba03003]

I believe nothing it can do on our side.
Do not use reply.raw directly since it bypass all logic we have.
Or do all the thing on your own if you really want to use reply.raw.