CORS error or empty response when hitting /graphql endpoint

[taylorcammack]

So, I'm currently tinkering with a Svelte app and wanted to use a local Statamic site I'd already set up as a data store.

First thing was to resolve CORS; found this Gist and it seemed pretty straight-forward. After updating Valet, I was able to run a simple fetch like this:

  fetch('http://core.test/api/taxonomies/industries/terms?filter[entries_count:gt]=0&fields=id,color,title,slug')
  .then(r => r.json())
  .then(data => industries = data.data)

For a different section, I have a query that involves hitting the GraphQL endpoint to request data. That looks something like this:

  onMount(async () => {
    fetch("http://core.test/graphql", {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json', 
      },
      body: JSON.stringify({
        query: employersQuery,
      }),
    })
    .then(response => response.json())
    .then(data => {
      console.log(data);
      apiData.set(data);
    }).catch(error => {
      console.log(error);
      return [];
    });
  });

This results in a CORS error.

When I remove the headers in the request, it goes through without a CORS error:

But the response is empty:

It should be noted that the query seems OK – I'm currently using in the Statamic site and, using Postman, I can hit the same endpoint and query and it returns the expected response.

Things I've tried:

• setting the mode in the request: cors, no-cors, etc.
• trying different combinations of headers
• adding the /graphql endpoint into the cors.php file in my Statamic site
• prayers of supplication and self-flagellation

Any ideas? 🙏

[taylorcammack]

Doubt that anyone else will have had this problem, but in case anyone was curious, the Statamic site we were using was originally set up as V3 was being developed and was (theoretically) being kept up to date with latest config/app changes. In this case, we had up-to-date config, but the $middleware array in app/Http/Kernel.php was missing the call to Fruitcake/Cors... so now the config actually does something lol