Can't get CORS working in Firefox - node.js

Question

I'm trying to get a simple example working with the MEAN stack and I noticed that my DELETE request does not work in Firefox. I believe this is due to CORS.
When i click a link to submit a DELETE request with angularJS to my ExpressJS backend, I see that a GET request is first called, and then the actual DELETE request is called, but the DELETE request never finishes.
This all seems to work in Chrome no problem. No unexpected GET request called, and the DELETE request actually finishes. How can I make this work in Firefox?
Express section for cors:
// CORS Stuff in app.js
app.all('*', function (req, res, next) {
res.header("Access-Control-Allow-Origin", "*");
res.header("Access-Control-Allow-Headers", "X-Requested-With, Content-Type, Authorization, Content-Length");
res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE,OPTIONS');
if(req.method == 'OPTIONS') {
res.send(204);
//next();
} else {
next();
}
//res.send(200);
});
app.get('/notes', note.get(db));
app.post('/notes', note.create(db));
app.put('/notes/:id', note.update(db));
app.delete('/notes/:id', note.delete(db));
Then i have this note.js file
exports.delete = function(db) {
return function(req, res) {
console.log('were in delete middleware');
//var note_id = req.body.id;
var note_id = req.params.id;
console.log("note_id = "+note_id);
var collection = db.get('notes');
collection.remove(
{_id: note_id}
),
function(err, doc) {
console.log('were in delete middleware function');
// If it failed, return error
if (err) {
console.log('were in delete error');
res.send("There was a problem deleting that note from the database.");
} else {
console.log('were in delete success');
res.send(200);
}
}
}
}
My browser url is http://localhost:63342/express_example/public/#/
Update
My server responds to the preflight request with this:
Server console:
OPTIONS /notes/53568807130e0f701f000001 200 0ms - 2b
GET /notes 304 8ms
Browser console:

Answer 1

So this is not a problem with CORS, you have a small logic error in your code.
The problem is with this call:
collection.remove(
{_id: note_id}
),
I'm going to assume that it expects a second parameter which is a callback function, which is probably why you ended the statement with a , and not a ;. Also you define the callback function as the next statement but never use it. Hence why the delete never ends, the callback is never called because it wasn't passed in to the collection.remove() call.
Try this instead:
var collection = db.get('notes');
collection.remove(
{_id: note_id},
function(err, doc) {
console.log('were in delete middleware function');
// If it failed, return error
if (err) {
console.log('were in delete error');
res.send("There was a problem deleting that note from the database.");
} else {
console.log('were in delete success');
res.send(200);
}
});
Not sure why this would work for Chrome and not for firefox, but if it had to guess it would be that Chrome might be getting the 204 back from your CORS handler and just be accepting it. Thats just a guess though because the code you posted above will never return a response back to a client.

Answer 2

You probably shouldn't auto-reply with a 204 response unless your Express handlers have actually deleted the object. You didn't post your handlers here, but with Mongoose/MongoDB it might look like:
app.delete('/records/:recordId', function(req, res){
req.record.remove(function(err){
if (err) {
console.log("Error deleting record");
return res.json(500, {error: err});
}
return res.json(204);
});
});

Answer 3

The problem with what you are doing is that it opens your server to requests from all domains. The reason it was failing before is if you notice the request header has a host of localhost: 3000 but your server is only accepting requests from localhost: 63342
You probably don't need to worry about opening it up to all domains unless you are worried about someone else making an application that is hitting your server that will be running on client computers. Anyone can hit the server using fiddler or any REST client like Advanced REST Client.