--cors-allow-origins-regex not working, but it works in the normal A1111 repo

[Keavon]

I have a docker-compose.override.yml with this

services:
  auto:
    environment:
      # - CLI_ARGS=--xformers --nowebui --cors-allow-origins=*
      - CLI_ARGS=--xformers --nowebui --cors-allow-origins-regex="https?://((localhost|127\.0\.0\.1|192\.168\.\d+\.\d+):\d+|(editor|dev)\.graphite\.rs|.*\.graphite\-master\.pages\.dev)"

Using this Docker container, --cors-allow-origins-regex does not seem to work. Browser requests receive an invalid CORS error. But switching to the --cors-allow-origins=* version does work.

I tested the same regex command on the ordinary A1111 repository (using Windows cmd.exe) and it works. Requests don't fail the CORS check.

I'm out of ideas, so I'm posting here for advice. Thanks.

[AbdBarho]

very random suggestion: can you try using single quotes instead of double quotes on the regex?

[AbdBarho]

The web UI already has a queue for all the calls:
https://github.com/AUTOMATIC1111/stable-diffusion-webui/blob/3715ece0adce7bf7c5e9c5ab3710b2fdc3848f39/modules/call_queue.py

Not sure if the same applies to the API

[AbdBarho]

Ok after a while of debugging, it seems to me that the CORS configuration in the webui does not work, there seems to be either a misconfiguration or misunderstanding on my side of what the configuration should be.

In any case, if you are doing fetch requests from the browser, you can try with {mode: 'no-cors'} and it works fine, the api sends the entire response regardless 🧠

Again, I would argue a reverse proxy will be easier to configure when it comes to CORS stuff, I have no experience with CloudFlare Workers, but if you can sanitize the inputs, I am sure you can check the origin headers and deny requests accordingly.

[Keavon]

That's true that this won't matter once the Cloudflare Workers system is set up. But I was hoping to fix this for use in testing before then. But since I'm keeping my URL private, it should be okay to keep using --cors-allow-origins=* I suppose. I'll have to try the {mode: 'no-cors'} suggestion, I seem to recall testing that before and it wasn't a solution to the relevant problem, but that may have been a slightly different scenario (I don't recall precisely). It just seems weird to me that it works in the normal A1111 repo but not from Docker.

[AbdBarho]

Agree, it is also very weird to me, I guess this might be related to the way how docker proxies all the requests that goes through it, especially on windows since it has to go through WSL first then the docker network (or vice versa)...

In any case, if you come across anything valuable, it would be much appreciated if you could report it here, maybe we can find a solution.

[Keavon]

That sounds like a sane theory. Docker and network engineering aren't really my specialty so I think it's unlikely I will find a solution that I can report back, but of course in the unlikely case I do, I certainly will return to update you on my findings. Thankfully this isn't really a blocker since I can keep using * which should be safe enough behind the Cloudflare Worker API proxy (which also lets me rewrite CORS headers as needed).