Comments (16)
For future reference, the current implementation of API gateway is based on KONG. From the document it seems KONG has limited support to enable CORS/cross-origin resource sharing.
https://docs.konghq.com/hub/kong-inc/cors/
from go-mod-bootstrap.
A quick verification/band aid style fix is to run Curl command against KONG. Here is the command that may work:
curl -X POST http://localhost:8001/plugins --data "name=cors" --data "config.origins=*" --data "config.methods=GET" --data "config.methods=POST" --data "config.headers=Accept" --data "config.headers=Accept-Version" --data "config.headers=Content-Length" --data "config.headers=Content-MD5" --data "config.headers=Content-Type" --data "config.headers=Date" --data "config.headers=X-Auth-Token" --data "config.exposed_headers=X-Auth-Token" --data "config.credentials=true" --data "config.max_age=3600"
from go-mod-bootstrap.
If anyone else is looking for a solution to this, simply using *
for origins did not work for me. Only when restricted to specific origins (with proper http
or https
AND port) did it work (i.e. config.origins=https://localhost:3000
)
Additionally, you will need to configure the OPTIONS
and other methods to be allowed on all the routes. I accomplished this with a simple loop in a script
ROUTES=(
"coredata"
"metadata"
"command"
"notifications"
"scheduler"
"rulesengine"
)
# Loop download each
for route in "${ROUTES[@]}"; do
curl -X PATCH "http://localhost:8001/routes/${route}/" \
--data "methods=OPTIONS" \
--data "methods=GET" \
--data "methods=POST" \
--data "methods=PUT" \
--data "methods=DELETE"
done
from go-mod-bootstrap.
Example utility for CORS from Intel reference implementation
https://github.com/intel-iot-devkit/automated-checkout-utilities/blob/0dd0e1e344399f3042b1f64b82ccbc2d2e0333aa/utilities.go#L69
We might be able to handle this in the middleware for REST
from go-mod-bootstrap.
Discussed in Core WG meeting 5/13/21. To be done for Jakarta release. Looking at whether there is common code (such as in bootstrapping) or if this needs to be added to edgex-go, SDKs (and associated services) separately as part of the request handling process. For Kong, we'll need to add the Kong plugin (https://docs.konghq.com/hub/kong-inc/cors/) - again for Jakarta
from go-mod-bootstrap.
It was decided in Security WG on 9/15/2021 that the project wants CORS support to be enabled even in the non-security use case. Persuant to this direction, we want to back out the changes for edgexfoundry/edgex-go#1913 and re-implement them in the EdgeX middleware instead of in Kong.
As such, we will back out commit edgexfoundry/edgex-go@25b03d0 of PR edgexfoundry/edgex-go#3678
The following configuration options should be added to the service to control the CORS headers:
EnableCORS = false
CORSAllowCredentials = false
CORSAllowedOrigins = "https://localhost"
CORSAllowedMethods = "GET, POST, PUT, DELETE"
CORSAllowedHeaders = "Content-Type"
CORSExposedHeaders = ""
CORSPreflightMaxAge = 3600
Actual real-life example from a Kong user:
curl -X POST http://localhost:8001/plugins/ \
--data "name=cors" \
--data "config.origins=http://yyy.yyy.yyy.yyy:4200" \
--data "config.methods=GET" \
--data "config.methods=POST" \
--data "config.methods=OPTIONS" \
--data "config.headers=Accept" \
--data "config.headers=Accept-Version" \
--data "config.headers=Content-Length" \
--data "config.headers=Content-MD5" \
--data "config.headers=Content-Type" \
--data "config.headers=Date" \
--data "config.headers=X-Auth-Token" \
--data "config.headers=Authorization" \
--data "config.exposed_headers=X-Auth-Token" \
--data "config.credentials=true" \
--data "config.max_age=3600"
from go-mod-bootstrap.
Middleware implementation should be done in https://github.com/edgexfoundry/go-mod-bootstrap and in C SDK
from go-mod-bootstrap.
More details on the proposed implementation.
- Add new CORS configuration settings above to ServiceInfo. Suggest sub-struct CorsInfo.
- Implement adding the CORS info (when enabled) to response header in the bootstrap handler here:
https://github.com/edgexfoundry/go-mod-bootstrap/blob/main/bootstrap/handlers/httpserver.go#L97
from go-mod-bootstrap.
@cloudxxx8 please take a look at the amount of work here
from go-mod-bootstrap.
it's not hard to add this implementation, but we need more time to test it manually
according to the current test infrastructure, we can't add automation tests for this because it needs multiple machines
from go-mod-bootstrap.
On Core WG call we agreed to add PATCH to the CORSAllowedMethods
i.e.
CORSAllowedMethods = "GET, POST, PUT, PATCH, DELETE"
@cloudxxx8 and team, please aim to complete in the next week if possible
from go-mod-bootstrap.
from go-mod-bootstrap.
Reopening the issue because I realized that we're not done. There is actually logic we need to implement on the server side.
https://www.html5rocks.com/en/tutorials/cors//#toc-cors-server-flowchart
Also need to set "Vary: Origin" when supporting CORS.
Note that the consul API does not currently expose CORS headers. There was a PR to add the feature, though it is pretty low-level: https://github.com/hashicorp/consul/pull/558/files
from go-mod-bootstrap.
@jpwhitemn @lenny-intel we might need to postpone the code freeze date for this issue
from go-mod-bootstrap.
Waiting for edgexfoundry/edgex-docs#608
from go-mod-bootstrap.
Issue has been resolved, but believe just Docs work to be done. Per TSC 11/10/21 - close this
from go-mod-bootstrap.
Related Issues (20)
- [WIP BUG] Writable settings in all-service should be ignored if setting exists in App/Device common Writable
- Make Env Overrides highest precedent , again HOT 1
- Add dev command line flag to apply "Host" env overrides when running in hybrid mode HOT 3
- fix RegisteredSecretUpdatedCallback naming and signature
- Ability to register a callback for when **any** Secret has been modified
- InsecureSecrets change detection does not work
- InsecureSecrets callback does not work for removed secrets HOT 1
- Dev flag override of Service.Host keeps Core Command from working with hybrid service
- External MQTT Rename SecretPath to SecretName HOT 1
- [URI4Files] Go- Implement reusable LoadFile function
- [URI4Files] Go- Refactor loading Config file to handle URI
- [URI4Files] Refactor GetConfigFileLocation to return URI HOT 1
- Replacement for Gorilla/MUX package
- Add better error handling in bootstrap handlers when Common Config is missing
- Move the common middleware functions to go-mod-bootstrap HOT 3
- Update http handler functions and middleware to use general signature HOT 1
- Add utility function to wrap http handler into Echo signature
- CORS configuration isn't overriden by environment variable HOT 4
- [URI4Files] Add unit test to validate header secret elements
- Add new -rsh/--remoteServiceHosts command line flag to set host names required when service is running remotely
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from go-mod-bootstrap.