You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@allura.apache.org by Dave Brondsema <da...@brondsema.net> on 2015/07/13 17:23:16 UTC
[allura:tickets] #7927 Enable CORS access to rest APIs
---
** [tickets:#7927] Enable CORS access to rest APIs**
**Status:** open
**Milestone:** unreleased
**Labels:** api
**Created:** Mon Jul 13, 2015 03:23 PM UTC by Dave Brondsema
**Last Updated:** Mon Jul 13, 2015 03:23 PM UTC
**Owner:** nobody
Original request: https://sourceforge.net/p/forge/feature-requests/426/
May need `.ini` settings if this is something that some sites would want and not others.
---
Sent from forge-allura.apache.org because dev@allura.apache.org is subscribed to https://forge-allura.apache.org/p/allura/tickets/
To unsubscribe from further messages, a project admin can change settings at https://forge-allura.apache.org/p/allura/admin/tickets/options. Or, if this is a mailing list, you can unsubscribe from the mailing list.
[allura:tickets] #7927 Enable CORS access to rest APIs
Posted by Dave Brondsema <da...@brondsema.net>.
- **Reviewer**: Dave Brondsema
---
** [tickets:#7927] Enable CORS access to rest APIs**
**Status:** review
**Milestone:** unreleased
**Labels:** api sf-2 sf-current 42cc
**Created:** Mon Jul 13, 2015 03:23 PM UTC by Dave Brondsema
**Last Updated:** Thu Jul 16, 2015 04:03 PM UTC
**Owner:** Igor Bondarenko
Original request: https://sourceforge.net/p/forge/feature-requests/426/
May need `.ini` settings if this is something that some sites would want and not others.
---
Sent from forge-allura.apache.org because dev@allura.apache.org is subscribed to https://forge-allura.apache.org/p/allura/tickets/
To unsubscribe from further messages, a project admin can change settings at https://forge-allura.apache.org/p/allura/admin/tickets/options. Or, if this is a mailing list, you can unsubscribe from the mailing list.
[allura:tickets] #7927 Enable CORS access to rest APIs
Posted by Igor Bondarenko <je...@gmail.com>.
- **labels**: api, sf-2, sf-current --> api, sf-2, sf-current, 42cc
- **status**: open --> in-progress
- **assigned_to**: Igor Bondarenko
---
** [tickets:#7927] Enable CORS access to rest APIs**
**Status:** in-progress
**Milestone:** unreleased
**Labels:** api sf-2 sf-current 42cc
**Created:** Mon Jul 13, 2015 03:23 PM UTC by Dave Brondsema
**Last Updated:** Mon Jul 13, 2015 03:47 PM UTC
**Owner:** Igor Bondarenko
Original request: https://sourceforge.net/p/forge/feature-requests/426/
May need `.ini` settings if this is something that some sites would want and not others.
---
Sent from forge-allura.apache.org because dev@allura.apache.org is subscribed to https://forge-allura.apache.org/p/allura/tickets/
To unsubscribe from further messages, a project admin can change settings at https://forge-allura.apache.org/p/allura/admin/tickets/options. Or, if this is a mailing list, you can unsubscribe from the mailing list.
[allura:tickets] #7927 Enable CORS access to rest APIs
Posted by Dave Brondsema <da...@brondsema.net>.
- **status**: review --> closed
- **Comment**:
Found two minor issues with the cache setting, and fixed them. Also added another test to assert a tricky attack vector stays closed.
---
** [tickets:#7927] Enable CORS access to rest APIs**
**Status:** closed
**Milestone:** unreleased
**Labels:** api sf-2 sf-current 42cc
**Created:** Mon Jul 13, 2015 03:23 PM UTC by Dave Brondsema
**Last Updated:** Thu Jul 16, 2015 09:04 PM UTC
**Owner:** Igor Bondarenko
Original request: https://sourceforge.net/p/forge/feature-requests/426/
May need `.ini` settings if this is something that some sites would want and not others.
---
Sent from forge-allura.apache.org because dev@allura.apache.org is subscribed to https://forge-allura.apache.org/p/allura/tickets/
To unsubscribe from further messages, a project admin can change settings at https://forge-allura.apache.org/p/allura/admin/tickets/options. Or, if this is a mailing list, you can unsubscribe from the mailing list.
[allura:tickets] #7927 Enable CORS access to rest APIs
Posted by Igor Bondarenko <je...@gmail.com>.
- **status**: in-progress --> review
- **Comment**:
Closed #821. `ib/7927`
QA instructions:
- See below the notes below depending on your setup
- Generate bearer token for at `/auth/oauth`
- Open [this script](https://forge-allura.apache.org/p/allura/pastebin/55a7cb736d19cd2b44c9758c) in your browser and play with various API endpoints/methods
Local notes:
- Uncomment `cors.enabled`, `cors.methods` and `cors.headers` in `development.ini`
- Comment out https check for APIs
`Allura/allura/controllers/rest.py`
#if not testing and request.scheme != 'https':
#request.environ['pylons.status_code_redirect'] = True
#raise exc.HTTPForbidden
Sandbox notes:
- Make sure you are using https for the request or else you will get constant 403
- Add `cors.enabled`, `cors.methods` and `cors.headers` to `production.ini`
- Enable passing auth headers in apache
`/etc/httpd/conf.d/allura-venv.conf`
WSGIPassAuthorization On
---
** [tickets:#7927] Enable CORS access to rest APIs**
**Status:** review
**Milestone:** unreleased
**Labels:** api sf-2 sf-current 42cc
**Created:** Mon Jul 13, 2015 03:23 PM UTC by Dave Brondsema
**Last Updated:** Tue Jul 14, 2015 07:31 AM UTC
**Owner:** Igor Bondarenko
Original request: https://sourceforge.net/p/forge/feature-requests/426/
May need `.ini` settings if this is something that some sites would want and not others.
---
Sent from forge-allura.apache.org because dev@allura.apache.org is subscribed to https://forge-allura.apache.org/p/allura/tickets/
To unsubscribe from further messages, a project admin can change settings at https://forge-allura.apache.org/p/allura/admin/tickets/options. Or, if this is a mailing list, you can unsubscribe from the mailing list.
[allura:tickets] #7927 Enable CORS access to rest APIs
Posted by Dave Brondsema <da...@brondsema.net>.
- **labels**: api --> api, sf-2, sf-current
---
** [tickets:#7927] Enable CORS access to rest APIs**
**Status:** open
**Milestone:** unreleased
**Labels:** api sf-2 sf-current
**Created:** Mon Jul 13, 2015 03:23 PM UTC by Dave Brondsema
**Last Updated:** Mon Jul 13, 2015 03:23 PM UTC
**Owner:** nobody
Original request: https://sourceforge.net/p/forge/feature-requests/426/
May need `.ini` settings if this is something that some sites would want and not others.
---
Sent from forge-allura.apache.org because dev@allura.apache.org is subscribed to https://forge-allura.apache.org/p/allura/tickets/
To unsubscribe from further messages, a project admin can change settings at https://forge-allura.apache.org/p/allura/admin/tickets/options. Or, if this is a mailing list, you can unsubscribe from the mailing list.
[allura:tickets] #7927 Enable CORS access to rest APIs
Posted by Dave Brondsema <da...@brondsema.net>.
- **labels**: api, sf-2, sf-current, 42cc --> api, sf-2, 42cc
---
** [tickets:#7927] Enable CORS access to rest APIs**
**Status:** closed
**Milestone:** unreleased
**Labels:** api sf-2 42cc
**Created:** Mon Jul 13, 2015 03:23 PM UTC by Dave Brondsema
**Last Updated:** Tue Jul 21, 2015 05:45 PM UTC
**Owner:** Igor Bondarenko
Original request: https://sourceforge.net/p/forge/feature-requests/426/
May need `.ini` settings if this is something that some sites would want and not others.
---
Sent from forge-allura.apache.org because dev@allura.apache.org is subscribed to https://forge-allura.apache.org/p/allura/tickets/
To unsubscribe from further messages, a project admin can change settings at https://forge-allura.apache.org/p/allura/admin/tickets/options. Or, if this is a mailing list, you can unsubscribe from the mailing list.