[Bug]: shopify app dev with cloudflare quick tunnel not proxying OPTIONS requests

[rhyek]

Please confirm that you have:

• Searched existing issues to see if your issue is a duplicate. (If you’ve found a duplicate issue, feel free to add additional information in a comment on it.)
• Reproduced the issue in the latest CLI version.

In which of these areas are you experiencing a problem?

Extension, Other

Expected behavior

When running shopify app dev command, I should be able to reach my backend process using curl and OPTIONS http method.

Actual behavior

It appears either cloudflare or maybe shopify cli is responding to the request, which prevents me from responding with custom CORS headers.

Verbose output

Verbose output

> redemption-shopify-integration@1.0.0 shopify /Users/carlos/Dev/truelogic/tyb/tyb-dev/projects/shopify-svc
> shopify app dev --verbose --skip-dependencies-installation

2025-04-17T00:15:03.207Z: Running command app dev
2025-04-17T00:15:03.210Z: Running system process in background:
· Command: /Users/carlos/.asdf/installs/nodejs/22.6.0/bin/node /Users/carlos/Dev/truelogic/tyb/tyb-dev/projects/shopify-svc/node_modules/@shopify/cli/bin/run.js notifications list --ignore-errors
· Working directory: /Users/carlos/Dev/truelogic/tyb/tyb-dev/projects/shopify-svc

2025-04-17T00:15:03.216Z: Notifications to show: 0
╭─ warning ──────────────────────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                                │
│  The flag `api-key` has been deprecated in favor of `client-id`                                                │
│                                                                                                                │
╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯

2025-04-17T00:15:03.242Z: Reading cached app information for directory /Users/carlos/Dev/truelogic/tyb/tyb-dev/projects/shopify-svc...
2025-04-17T00:15:03.242Z: Reading the content of file at shopify.app.toml...
2025-04-17T00:15:03.244Z: Reading the content of file at shopify.app.toml...
2025-04-17T00:15:03.245Z: Ensuring that the user is authenticated with the Partners API with the following scopes:
[]

2025-04-17T00:15:03.246Z: Getting session store...
2025-04-17T00:15:03.247Z: Validating existing session against the scopes:
[
"openid",
"https://api.shopify.com/auth/shop.admin.graphql",
"https://api.shopify.com/auth/shop.admin.themes",
"https://api.shopify.com/auth/partners.collaborator-relationships.readonly",
"https://api.shopify.com/auth/shop.storefront-renderer.devtools",
"https://api.shopify.com/auth/partners.app.cli.access",
"https://api.shopify.com/auth/destinations.readonly",
"https://api.shopify.com/auth/organization.store-management",
"https://api.shopify.com/auth/organization.apps.manage"
]
For applications:
{
"partnersApi": {
  "scopes": []
}
}

to https://partners.shopify.com/api/cli/graphql
2025-04-17T00:15:06.752Z: 2025-04-17T00:15:06Z INF Thank you for trying Cloudflare Tunnel. Doing so, without a Cloudflare account, is a quick way to experiment and try it out. However, be aware that these account-less Tunnels have no uptime guarantee. If you intend to use Tunnels in production you should use a pre-created named tunnel by following: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps
2025-04-17T00:15:06Z INF Requesting new quick Tunnel on trycloudflare.com...

2025-04-17T00:15:07.350Z: Request to https://partners.shopify.com/api/cli/graphql completed in 609 ms
With response headers:
- cache-control: max-age=0, private, must-revalidate
- content-type: application/json; charset=utf-8
- etag: W/"dc459c144e8d35a14af52a44fba156fd"
- server-timing: processing;dur=426, socket_queue;dur=2.241, util;dur=1.0, cfRequestDuration;dur=475.999832
- x-request-id: f3b11ac1-6666-4271-9f3a-c7c1c0ccafba-1744848906
  
2025-04-17T00:15:07.353Z: Reading cached app information for directory /Users/carlos/Dev/truelogic/tyb/tyb-dev/projects/shopify-svc...
╭─ info ─────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                                │
│  Using shopify.app.toml for default values:                                                                    │
│                                                                                                                │
│    • Org:             TYB Test                                                                                 │
│    • App:             tyb-dev-carlos                                                                           │
│    • Dev store:       tyb-dev-carlos.myshopify.com                                                             │
│    • Update URLs:     Yes                                                                                      │
│                                                                                                                │
│   You can pass `--reset` to your command to reset your app configuration.                                      │
│                                                                                                                │
╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯

2025-04-17T00:15:07.359Z: Reading the content of file at shopify.app.toml...
2025-04-17T00:15:07.361Z: Writing some content to file at shopify.app.toml...
2025-04-17T00:15:07.363Z: Port 3457 is free
2025-04-17T00:15:07.365Z: Polling tunnel status for cloudflare (attempt 0): starting
2025-04-17T00:15:07.365Z: Getting a random port...
2025-04-17T00:15:07.366Z: Random port obtained: 58034
2025-04-17T00:15:07.865Z: Polling tunnel status for cloudflare (attempt 1): starting
2025-04-17T00:15:08.367Z: Polling tunnel status for cloudflare (attempt 2): starting
2025-04-17T00:15:08.868Z: Polling tunnel status for cloudflare (attempt 3): starting
2025-04-17T00:15:09.367Z: Polling tunnel status for cloudflare (attempt 4): starting
2025-04-17T00:15:09.868Z: Polling tunnel status for cloudflare (attempt 5): starting
2025-04-17T00:15:10.369Z: Polling tunnel status for cloudflare (attempt 6): starting
2025-04-17T00:15:10.701Z: 2025-04-17T00:15:10Z INF +--------------------------------------------------------------------------------------------+
2025-04-17T00:15:10Z INF |  Your quick Tunnel has been created! Visit it at (it may take some time to be reachable):  |
2025-04-17T00:15:10Z INF |  https://drugs-south-logo-mention.trycloudflare.com                                        |
2025-04-17T00:15:10Z INF +--------------------------------------------------------------------------------------------+

2025-04-17T00:15:10.702Z: 2025-04-17T00:15:10Z INF Cannot determine default configuration path. No file [config.yml config.yaml] in [~/.cloudflared ~/.cloudflare-warp ~/cloudflare-warp /etc/cloudflared /usr/local/etc/cloudflared]
2025-04-17T00:15:10Z INF Version 2024.8.2
2025-04-17T00:15:10Z INF GOOS: darwin, GOVersion: go1.22.2-devel-cf, GoArch: arm64
2025-04-17T00:15:10Z INF Settings: map[ha-connections:1 no-autoupdate:true protocol:quic url:http://localhost:58013]

2025-04-17T00:15:10.702Z: 2025-04-17T00:15:10Z INF Generated Connector ID: f55542f7-73bf-4eb1-acb6-eb4b9132d80b

2025-04-17T00:15:10.858Z: 2025-04-17T00:15:10Z INF Initial protocol quic

2025-04-17T00:15:10.858Z: 2025-04-17T00:15:10Z INF ICMP proxy will use 192.168.50.122 as source for IPv4

2025-04-17T00:15:10.858Z: 2025-04-17T00:15:10Z INF ICMP proxy will use fe80::1007:4a6e:6b7e:e54a in zone en0 as source for IPv6

2025-04-17T00:15:10.858Z: 2025-04-17T00:15:10Z INF Created ICMP proxy listening on 192.168.50.122:0

2025-04-17T00:15:10.858Z: 2025-04-17T00:15:10Z INF Created ICMP proxy listening on [fe80::1007:4a6e:6b7e:e54a%en0]:0

2025-04-17T00:15:10.870Z: Polling tunnel status for cloudflare (attempt 7): starting
2025-04-17T00:15:10.881Z: 2025-04-17T00:15:10Z ERR update check failed error="no release found"

2025-04-17T00:15:10.944Z: 2025-04-17T00:15:10Z INF Starting metrics server on 127.0.0.1:58122/metrics

2025-04-17T00:15:11.335Z: 2025-04-17T00:15:11Z INF Registered tunnel connection connIndex=0 connection=e7c48d24-b1dc-4b4c-8e38-12be00e0210b event=0 ip=198.41.192.107 location=mia02 protocol=quic

2025-04-17T00:15:11.369Z: Polling tunnel status for cloudflare (attempt 8): connected
2025-04-17T00:15:11.370Z: Getting a random port...
2025-04-17T00:15:11.370Z: Random port obtained: 58132
2025-04-17T00:15:11.370Z: Reading cached app information for directory /Users/carlos/Dev/truelogic/tyb/tyb-dev/projects/shopify-svc...
2025-04-17T00:15:11.375Z: Sending "Partners" GraphQL request:
mutation appUpdate($apiKey: String!, $applicationUrl: Url!, $redirectUrlWhitelist: [Url]!, $appProxy: AppProxyInput) {
  appUpdate(
    input: {
      apiKey: $apiKey
      applicationUrl: $applicationUrl
      redirectUrlWhitelist: $redirectUrlWhitelist
      appProxy: $appProxy
    }
  ) {
    userErrors {
      message
      field
    }
  }
}

With variables:
{
"apiKey": "*****",
"applicationUrl": "https://drugs-south-logo-mention.trycloudflare.com",
"redirectUrlWhitelist": [
  "https://drugs-south-logo-mention.trycloudflare.com/api/auth/callback"
],
"appProxy": {
  "proxyUrl": "https://drugs-south-logo-mention.trycloudflare.com",
  "proxySubPath": "api",
  "proxySubPathPrefix": "apps"
}
}

With request headers:
- User-Agent: Shopify CLI; v=3.78.0
- Keep-Alive: timeout=30
- Sec-CH-UA-PLATFORM: darwin
- Content-Type: application/json

to https://partners.shopify.com/api/cli/graphql
2025-04-17T00:15:12.065Z: Request to https://partners.shopify.com/api/cli/graphql completed in 690 ms
With response headers:
- cache-control: max-age=0, private, must-revalidate
- content-type: application/json; charset=utf-8
- etag: W/"76acb4e44b91f928c3744a856cacdd2e"
- server-timing: processing;dur=529, socket_queue;dur=2.404, util;dur=0.5, cfRequestDuration;dur=582.999945
- x-request-id: 4ddd8a86-5052-4b7d-ab5f-d912f396bfaf-1744848911
  
.......
› Press d │ toggle development store preview: ✔ on
› Press g │ open GraphiQL (Admin API) in your browser
› Press p │ preview in your browser
› Press q │ quit

Preview URL: https://drugs-south-logo-mention.trycloudflare.com/extensions/dev-console
GraphiQL URL: http://localhost:3457/graphiql

Reproduction steps

1. have express backend (old shopify app template)
2. log all requests in middleware
3. run pnpm shopify app dev
4. do curl -i https://xxxx.trycloudflare.com/api/extensions/hello-world
5. endpoint responds with x-powered-by: Express header
6. request is logged
7. do curl -i -X OPTIONS https://xxxx.trycloudflare.com/api/extensions/hello-world
8. get a response with no x-powered-by: Express header
9. request is not logged

Additionally, I tried opening the tunnel directly using node_modules/@shopify/cli/bin/cloudflared tunnel --url http://localhost:4007 and when doing curl -i -X OPTIONS https://yyyy.trycloudflare.com/api/extensions/hello-world I get the x-powered-by: Express header again and the request is logged. So there's something happening when running shopify app dev specifically.

Operating System

macOS Sequoia

Shopify CLI version (shopify --version)

@shopify/cli/3.78.0 darwin-arm64 node-v22.6.0

Shell

zsh

Node version (run node -v if you're not sure)

22.6.0

What language and version are you using in your application?

Nodejs

[rhyek]

So my setup is using an old template that uses express for the backend, and the main entry point for the app is the frontend with vite that proxies api/ requests to that express app. I needed to change the cors setting in the defineConfig and that solved it.