403 Error when aiohttp resources are not fully merged

[FabianElsmer]

Aiohttp merges resources, when they are added in the correct order:

When using aiohttp-cors, resources have to be fully merged, or you end up having 2 resources for the same path, one for the GET method one for the POST, but the latter will not be considered when aiohttp-cors answers the OPTIONS request. It seems that aiohttp-cors supports only a single resource per path.

It would be nice if a hint about this could be added to the docs, if the support of multiple resources for the same path is too complex.

Requirements:

aiohttp==3.0.6
aiohttp_cors==0.7.0

Replicate:

def handler():
    pass

app.router.add_route('POST', '/a', handler)
app.router.add_route('GET', '/b', handler)
app.router.add_route('PUT', '/a', handler)

# Configure default CORS settings.
cors = aiohttp_cors.setup(app, defaults={
    "*": aiohttp_cors.ResourceOptions(
    allow_credentials=True,
    expose_headers="*",
    allow_headers="*")
})

# Configure CORS on all routes.
for route in list(app.router.routes()):
    cors.add(route)

[IgorKuzmenko]

@FabianElsmer we faced with the same issue, allow_methods="*" - could help you.
you could try this:

cors = aiohttp_cors.setup(app, defaults={
"*": aiohttp_cors.ResourceOptions(
            allow_credentials=True,
            expose_headers="*",
            allow_headers="*",
            allow_methods="*"
        )
    })