Enable CORS between Flex Plugins and Functions

(warning)

Warning

This example uses headers and cookies, which are only accessible when your Function is running @twilio/runtime-handler version 1.2.0 or later. Consult the Runtime Handler guide to learn more about the latest version and how to update.

A common use case is to call Functions from a Flex Plugin to retrieve external data such as statistics. Sometimes, this results in Cross-Origin Resource Sharing (CORS) restrictions in production environments due to the different hostnames between the Flex Plugin and the Function being called.

Fortunately, CORS errors, in this context or other situations, can be addressed by leveraging the response headers of the Function to allow any Origin, as shown in the following example code.

Create and host a Function

In order to run any of the following examples, you will first need to create a Function into which you can paste the example code. You can create a Function using the Twilio Console or the Serverless Toolkit as explained below:

ConsoleServerless Toolkit

If you prefer a UI-driven approach, creating and deploying a Function can be done entirely using the Twilio Console and the following steps:

Log in to the Twilio Console and navigate to the Functions tab. If you need an account, you can sign up for a free Twilio account here!
Functions are contained within Services. Create a Service by clicking the Create Service button and providing a name such as test-function.
Once you've been redirected to the new Service, click the Add + button and select Add Function from the dropdown.
This will create a new Protected Function for you with the option to rename it. The name of the file will be path it is accessed from.
Copy any one of the example code snippets from this page that you want to experiment with, and paste the code into your newly created Function. You can quickly switch examples by using the dropdown menu of the code rail.
Click Save to save your Function's contents.
Click Deploy All to build and deploy the Function. After a short delay, your Function will be accessible from: https://<service-name>-<random-characters>-<optional-domain-suffix>.twil.io/<function-path>
For example: test-function-3548.twil.io/hello-world.

The Serverless Toolkit enables you with local development, project deployment, and other functionality via the Twilio CLI. To get up and running with these examples using Serverless Toolkit, follow this process:

From the CLI, run twilio serverless:init <your-service-name> --empty to bootstrap your local environment.
Navigate into your new project directory using cd <your-service-name>
In the /functions directory, create a new JavaScript file that is named respective to the purpose of the Function. For example, sms-reply.protected.js for a Protected Function intended to handle incoming SMS.
Populate the file using the code example of your choice and save. Note A Function can only export a single handler. You will want to create separate files if you want to run and/or deploy multiple examples at once.

Once your Function(s) code is written and saved, you can test it either by running it locally (and optionally tunneling requests to it via a tool like ngrok), or by deploying the Function and executing against the deployed url(s).

Run your Function in local development

Run twilio serverless:start from your CLI to start the project locally. The Function(s) in your project will be accessible from http://localhost:3000/sms-reply

If you want to test a Function as a Twilio webhook, run: twilio phone-numbers:update <your Twilio phone number> --sms-url "http://localhost:3000/sms-reply"
This will automatically generate an ngrok tunnel from Twilio to your locally running Function, so you can start sending texts to it. You can apply the same process but with the voice-url flag instead if you want to test with Twilio Voice.
If your code does not connect to Twilio Voice/Messages as a webhook, you can start your dev server and start an ngrok tunnel in the same command with the ngrok flag. For example: twilio serverless:start --ngrok=""

Deploy your Function

To deploy your Function and have access to live url(s), run twilio serverless:deploy from your CLI. This will deploy your Function(s) to Twilio under a development environment by default, where they can be accessed from:

https://<service-name>-<random-characters>-dev.twil.io/<function-path>

For example: https://incoming-sms-examples-3421-dev.twil.io/sms-reply

Your Function is now ready to be invoked by HTTP requests, set as the webhook of a Twilio phone number, invoked by a Twilio Studio Run Function Widget, and more!

Enable CORS

Allow for a client-side Flex Plugin to communicate with a Function on a different host

1exports.handler = (context, event, callback) => {
2  // Access the NodeJS Helper Library by calling context.getTwilioClient()
3  const client = context.getTwilioClient();
4
5  // Create a custom Twilio Response
6  const response = new Twilio.Response();
7  // Set the CORS headers to allow Flex to make an error-free HTTP request
8  // to this Function
9  response.appendHeader('Access-Control-Allow-Origin', '*');
10  response.appendHeader('Access-Control-Allow-Methods', 'OPTIONS, POST, GET');
11  response.appendHeader('Access-Control-Allow-Headers', 'Content-Type');
12
13  // Use the NodeJS Helper Library to make an API call and gather
14  // statistics for the Flex Plugin.
15  // Note that the workspace SID is passed from the event parameter
16  // of the incoming request.
17  client.taskrouter.v1
18    .workspaces(event.WorkspaceSid)
19    .workers()
20    .cumulativeStatistics()
21    .fetch()
22    .then((data) => {
23      response.appendHeader('Content-Type', 'application/json');
24      response.setBody(data);
25      // Return a success response using the callback function
26      return callback(null, response);
27    })
28    .catch((err) => {
29      response.appendHeader('Content-Type', 'plain/text');
30      response.setBody(err.message);
31      response.setStatusCode(500);
32      // If there's an error, send an error response.
33      // Keep using the response object for CORS purposes.
34      return callback(null, response);
35    });
36};

If you want to learn more about Flex Plugins that would be invoking a Function in this way, check out this tutorial on calling a Function from a Flex Plugin.