OSLC/oslc-browser

Add guidance on CORS

Opened this issue · 3 comments

berezovskyi commented

Without disabling any Chrome security:

image

  1. Header set Access-Control-Allow-Headers "Content-Type, OSLC-Core-Version" (Apache) needs to be added so that JS code can send OSLC-Core-Version header (as per https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers) as well as use non-common Content-Type such as RDF (see https://developer.mozilla.org/en-US/docs/Glossary/CORS-safelisted_request_header#Additional_restrictions as to why)
  2. Header set Content-Security-Policy "frame-ancestors 'self' *;" + Header set Access-Control-Allow-Methods "GET, POST, OPTIONS" allows other websites to use an OSLC client to talk to their endpoint as well as to embed their delegated UIs in an IFRAME.
  3. Header set Access-Control-Allow-Credentials "true" allows cookies to be forwarded by the browser on JS requests. However, this feature does not allow a '*' in Access-Control-Allow-Origin. The server MUST reply Access-Control-Allow-Origin: http://localhost:3001 if it wants to let the browser pass auth cookies along with an OSLC Client JS request from that page. This is the only thing that cannot be done via "server config" and shall be done in the response phase of the OSLC server.
berezovskyi commented

See oslc-op/oslc-specs#458 for the backstory

berezovskyi commented

@jadelkhoury here is an extra requirement for the Access-Control-Allow-Headers (not applicable to Delegated UIs, just for OSLC Clients running in the browser)