Firebase onCall CORS issue

Question

我刚刚用react和vite创建了一个firebase项目，我已经按照如下方式配置了我的应用程序:

import { initializeAppCheck, ReCaptchaV3Provider } from "firebase/app-check"
import { connectAuthEmulator, getAuth } from "firebase/auth"
import { connectFirestoreEmulator, getFirestore } from "firebase/firestore"
import { connectFunctionsEmulator, getFunctions } from "firebase/functions"
import { connectStorageEmulator, getStorage } from "firebase/storage"
import { getApp, initializeApp } from "firebase/app"
const firebaseConfig = {
apiKey: import.meta.env.VITE_FIREBASE_API_KEY,
authDomain: import.meta.env.VITE_FIREBASE_AUTH_DOMAIN,
projectId: import.meta.env.VITE_FIREBASE_PROJECT_ID,
storageBucket: import.meta.env.VITE_FIREBASE_STORAGE_BUCKET,
messagingSenderId: import.meta.env.VITE_FIREBASE_MESSAGING_SENDER_ID,
appId: import.meta.env.VITE_FIREBASE_APP_ID,
measurementId: import.meta.env.VITE_FIREBASE_MEASUREMENT_ID,
}
initializeApp(firebaseConfig)
const FireApp = getApp()
const isPreview = import.meta.env.VITE_PREVIEW_MODE === "true"
if (isPreview === undefined || !isPreview)
initializeAppCheck(FireApp, {
provider: new ReCaptchaV3Provider(
import.meta.env.VITE_RECAPTCHA_PUBLIC_KEY
),
isTokenAutoRefreshEnabled: true,
})
const FireAuth = getAuth(FireApp)
FireAuth.languageCode = "fr"
const Firestore = getFirestore(FireApp)
const FireFunction = getFunctions(FireApp, "europe-west3")
const FireStorage = getStorage(FireApp)
const isDev = import.meta.env.DEV
if (isDev) {
// See all Firebase features ports in firebase.json
connectAuthEmulator(FireAuth, "http://localhost:9099")
connectFirestoreEmulator(Firestore, "localhost", 8080)
connectFunctionsEmulator(FireFunction, "localhost", 5001)
connectStorageEmulator(FireStorage, "localhost", 9199)
}
export { FireApp, FireAuth, Firestore, FireFunction, FireStorage }

我有一个函数httpCallable:

export const generateThings = functions
.region("europe-west3")
.runWith({
enforceAppCheck: !isPreview,
})
.https.onCall((data, context) => {
try {
if (!context.auth) {
const error = Error("Request not allowed")
return send("unauthenticated", error)
}
const things: Things = data
const userThings = generateThings(things)
return send<Things>("ok", userThings, "Things generation success")
} catch (error) {
return send("cancelled", error)
}
})

const generateThings = httpsCallable<
Things,
ApiResponse<Things | ApiError>
>(FireFunction, "generateThings")
const generateWorkout = async (
wkgArgs: WKGArgs
): Promise<ApiResponse<WKGWorkout | ApiError>> => {
const { data } = await generateWKGWorkout(wkgArgs)
return data
}

如果我设置allUsers授权在谷歌云控制台(云功能设置)一切工作，但如果我删除allUser授权我得到这个CORS错误:

访问从'https://workoutgen-staging.web '获取'https://europe-west3-workoutgen-staging.cloudfunctions.net/faStudioWKGgenerateWKGWorkout'。对预飞行请求的响应未通过访问控制检查:请求的资源上不存在"access - control - allow - origin"标头。如果一个不透明的响应满足你的需要，设置请求的模式为'no-cors'来获取CORS禁用的资源。

这对我来说有点困惑，在firebase文档中，他们解释说你必须把allUsers放进去才能工作，但这使得这个功能在互联网上是公开的。

我突然不明白onCall函数和onRequest函数相比有什么好处

有人理解吗?是否有可能在没有CORS问题的情况下保持一个随叫随到的私有函数?

Answer 1

您必须像这样在文件中导入CROS:-

const cors = require('cors')({origin: true});

如果不行请回复我。