Unable to access assets due to CORS

[filoxo]

OS?

Mac OSX El Capitan

Versions.

angular-cli: 1.0.0-beta.18
node: 6.7.0
os: darwin x64

Repro steps.

• Upgraded from angular-cli@1.0.0-beta.16 to 1.0.0-beta.18 (as well as Typescript from 2.0.2 to ~2.0.3).
• Changed assets key in angular-cli.json to array of strings.

The log given by the failure.

XMLHttpRequest cannot load http://localhost:4200/assets/i18n/en.json. 
No 'Access-Control-Allow-Origin' header is present on the requested resource. 
Origin 'http://localhost:8080' is therefore not allowed access.

Mention any other details that might be useful.

My use case: I am not using the generated index.html, but instead use Java/Spring. I run both the backend and the CLI concurrently, the CLI dev-server acting as a local CDN for development. Therefore the page is served from the backend on :8080 and the Angular app from :4200.

Related to #803 though for different reasons since the CLI now uses Webpack/webpack-dev-server. Because the CLI doesn't expose any config for webpack, users can't enable CORS themselves. This seemed to work previously without any issue. Attempts to downgrad to beta.16 (npm i -g angular-cli@1.0.0-beta.16) seem to either install beta.18 again or fail with error:

Cannot read property 'AssetUrl' of undefined
TypeError: Cannot read property 'AssetUrl' of undefined

[filoxo]

I was able to successfully downgrade my project CLI 1.0.0-beta.16; globally installing this version seems to succeed but I get error Cannot find module '@angular-cli/ast-tools when attempting to use outside of a CLI project. My project now works again, but won't be able to upgrade to the latest version of the CLI until a solution allows me to access assets from another origin.

[filipesilva]

Would you be willing to make a PR that enables CORS for ng serve? I'm happy to review it.

[cacogr]

As a workaround I'm using a browser extension that sets the header Access-Control-Allow-Origin: * using a filter for requests matching the pattern *://localhost*/*.

https://chrome.google.com/webstore/detail/allow-control-allow-origi/nlfbmbojpeacfghkpbjhddihlkkiljbi