Make API calls inside Electron (VSCode)

[LasaleFamine]

Hi there and firstly thanks for the amazing product that is Sanity, really, awesome work! 👍

My problem is related to the CORS: I'm trying to get releases informations about a VSCode extension of mine and display them inside a VSCode webview as changelogs. The problem is that I'm getting a CORS error related to the obviously null origin that came from Electron request:

Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access.

Is there any way to solve this problem?

[kmelve]

Thanks @LasaleFamine – and what a cool way to use Sanity!

I tried forking and starting up the VSCode ext. project locally to see what's going on, but it stopped on the get-remote-icons-task because I haven't the correct credentials.

A short in the dark, but maybe this thread can give some clues? electron/electron#7931 (comment)

[LasaleFamine]

Hi @kmelve, thanks for your response.

I think actually I can't access the Electron APIs from inside VSCode, see: microsoft/vscode#3011

I'm wondering: is there any way to "fake" the Origin header before make any calls from the Sanity client? In this way I can emulate the solution mentioned on the Electron issue and just add that specific origin within my Sanity configuration for authentication. Do you think this is possible?

[kmelve]

I understand – we're looking into how we can better accommodate for your kind of use. There are suggestions on the table, but we just need to evaluate them. Stay tuned!

[LasaleFamine]

Hi guys, sorry for bothering you, but are there any news about this one?

[kmelve]

It's no bother at all @LasaleFamine! This is definitely on the agenda. We are just considering the security implications and how to make it easy for everyone to keep their users safe.

If you come by our slack and DM me, we'll make the wait worth your while!

[rexxars]

We now support wildcards, file origins (file:///* explicitly) and null as a value!