REST API issue with Postman & Co

I’m trying to implement a simple REST API that allows CORS so that also external clients can use the REST API. With the browser and CURL I’m able to call the REST API but with other clients like Postman or Restlet Client the request is ending up in a HTTP 302 Found response.

GET http://localhost:8080/index.php/apps/corsdemo/api/1.0/author

  • Browser & CURL: {"authors":"123"} (no redirect, direct 200 OK response)
  • Postman: Could not get any response (302 Found)
  • Restlet: We are sorry, but Chrome API does not allow to get a response body for redirect. (302 Found)

Seems like Nextcloud is trying to perform a redirect in case of Postman and Restlet. Any ideas how I can avoid this issue?

I’ve uploaded my example here https://github.com/subesokun/nextcloud-cors-demo

Btw. I’m using Nextcloud 12.

Nextcloud log when trying to fetch data via Postman

nextcloud_1  | 172.18.0.1 - - [13/Aug/2017:15:26:51 +0000] "GET /index.php/apps/corsdemo/api/1.0/author HTTP/1.1" 302 1165 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36"
nextcloud_1  | 172.18.0.1 - - [13/Aug/2017:15:26:52 +0000] "GET /index.php/apps/corsdemo/api/1.0/author HTTP/1.1" 302 1164 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36"
nextcloud_1  | 172.18.0.1 - - [13/Aug/2017:15:26:52 +0000] "GET /index.php/apps/corsdemo/api/1.0/author HTTP/1.1" 302 1164 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36"
nextcloud_1  | 172.18.0.1 - - [13/Aug/2017:15:26:52 +0000] "GET /index.php/apps/corsdemo/api/1.0/author HTTP/1.1" 302 1164 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36"
...

Check the app tutorial app in the next cloud github organisation

First one is curl, second is Postman (freshly installed)

127.0.0.1 - - [14/Aug/2017:10:19:35 +0200] "GET /index.php/apps/corsdemo/api/1.0/author HTTP/1.1" 200 17
127.0.0.1 - - [14/Aug/2017:10:23:03 +0200] "GET /index.php/apps/corsdemo/api/1.0/author HTTP/1.1" 200 17

And a screenshot: