CORS in Phoenix

The page says that single page applications depend on a backend for data, authentication, and permissions, and that Phoenix works well as a JSON API for a JavaScript front end. It then introduces CORS as the browser agreement that allows requests across domains, including the pre-flight OPTIONS request that checks which methods are allowed.

Reading notes

#

• SPAs are presented as relying on a backend to fetch and send data, and the API also handles authentication and permissions.
• Phoenix is described as a strong JSON API for JavaScript front ends, built in Elixir.
• CORS is defined as the mechanism that lets resources be requested from another domain, using request and response headers.
• Modern browsers can send a pre-flight request before the main request to confirm whether it will be permitted.
• In Phoenix, CORS can be handled with plugs such as CORSPlug or Corsica, added to the :api pipeline.
• A problem appears when OPTIONS requests return 404 because no matching route exists, so the plug is never called.
• The fix shown is to define options routes for the relevant endpoints so the plug can intercept the request correctly.