Change in ovirt-engine[master]: restapi: Add CORS filter

29 Jan 2015

      Juan Hernandez has submitted this change and it was merged.

Change subject: restapi: Add CORS filter
......................................................................

restapi: Add CORS filter

This patch adds CORS (Cross Origin Resource Sharing) support to the
RESTAPI. This is based on the existing CORS filter developed by eBay and
available here:

  https://github.com/ebay/cors-filter

On top of that filter this patch adds the possibility to configure it
with two configuration parameters stored in the engine database and
supported by the "engine-config" tool:

  CORSSupport:
  This is a boolean parameter that indicates if the CORS support should
  be enabled. If its value is "false" then the support will be disabled
  and the RESTAPI will behave exactly as before intoducing this patch.
  If the value is "true" then the CORS support will be enabled, but by
  default no origin will be allowed, so the second parameter has also
  to be configured correctly. The default value is "false".

  CORSAllowedOrigin:
  This is a comma separated list of the allowed origins. If it is empty
  CORS support will be effectively disabled, even if the value of the
  "CORSSupport" parameter is "true". It can also have the special value
  "*", and in that case all origins will be allowed.

In practice, to use the filter, both parameters need to be set. For
example, in order to allow requests from scripts downloaded from the
"my.app" the following configuration changes are required:

  # engine-config -s CORSSupport=true
  # engine-config -s CORSAllowedOrigins=http://my.app
  # systemctl ovirt-engine restart

To test the filter you can use a simple JavaScript application like the
following deployed in the root of the web server of "my.app":

  <html>
    <head>
      <script>
        function onGet() {
          var xhr = prepareRequest("GET");
          xhr.send();
        }

        function prepareRequest(method) {
          var url = document.getElementById("url");
          var user = document.getElementById("user");
          var password = document.getElementById("password");
          var body = document.getElementById("body");
          var xhr = new XMLHttpRequest();
          xhr.open(method, url.value);
          xhr.setRequestHeader("Authorization", "Basic " + window.btoa(user.value + ":" + password.value));
          xhr.setRequestHeader("Accept", "application/xml");
          xhr.setRequestHeader("Content-Type", "application/xml");
          xhr.onload = function (e) {
            var text = xhr.responseText;
            body.value = text;
          };
          return xhr;
        }
      </script>
    </head>
    <body>
      <form action="">
       <table>
         <tr>
           <td>URL</td>
           <td><input id="url" type="text" value="https://my.engine/ovirt-engine/api"/></td>
         </tr>
         <tr>
           <td>User</td>
           <td><input id="user" type="text" value="admin@internal"/></td>
         </tr>
         <tr>
           <td>Password</td>
           <td><input id="password" type="password" value=""/></td>
         </tr>
         <tr>
           <td colspan="2">
             <div>
               Body
             </div>
             <div>
               <textarea id="body" rows="10" cols="80">
               </textarea>
             </div>
           </td>
         </tr>
         <tr>
          <td colspan="2">
            <input type="button" value="GET" onclick="onGet()"/>
         </tr>
       </table>
      </form>
    </body>
  </html>

When running this application the browser should send an initial OPTIONS
request to the server, asking for permission to send the actual request:

  OPTIONS /ovirt-engine/api HTTP/1.1
  Host: my.engine
  Origin: http://my.app
  Access-Control-Request-Method: GET
  Access-Control-Request-Headers: accept,authorization,content-type
  ...

The server should then respond with something like this:

  HTTP/1.1 200 OK
  Access-Control-Allow-Headers: accept,content-type,authorization
  Access-Control-Allow-Methods: GET
  Access-Control-Allow-Origin: http://my.app
  Access-Control-Max-Age: 1800
  Access-Control-Allow-Credentials: true
  ...

Then the browser will send the actual GET request, as the server
approved it.

For more details about the CORS protocol see here:

  W3C:
  http://www.w3.org/TR/cors

  Mozilla:
  https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS

Change-Id: I40f9a13105fe99bb6b4035e61b8945efd8315f57
Bug-Url: https://bugzilla.redhat.com/1181530
Signed-off-by: Juan Hernandez <juan.hernandez@redhat.com>
---
M backend/manager/dependencies/common/pom.xml
A backend/manager/dependencies/common/src/main/modules/org/ebaysf/web/cors-filter/main/module.xml
M backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/Backend.java
M backend/manager/modules/common/src/main/java/org/ovirt/engine/core/common/config/ConfigValues.java
M backend/manager/modules/common/src/main/java/org/ovirt/engine/core/common/queries/ConfigurationValues.java
M backend/manager/modules/common/src/main/java/org/ovirt/engine/core/common/queries/GetConfigurationValueParameters.java
M backend/manager/modules/restapi/interface/common/jaxrs/pom.xml
A backend/manager/modules/restapi/interface/common/jaxrs/src/main/java/org/ovirt/engine/api/common/security/CORSSupportFilter.java
M backend/manager/modules/restapi/interface/common/jaxrs/src/main/modules/org/ovirt/engine/api/interface-common-jaxrs/main/module.xml
M backend/manager/modules/restapi/webapp/src/main/webapp/WEB-INF/web.xml
M packaging/dbscripts/upgrade/pre_upgrade/0000_config.sql
M packaging/etc/engine-config/engine-config.properties
12 files changed, 289 insertions(+), 20 deletions(-)

Approvals:
  Juan Hernandez: Verified; Looks good to me, approved
  Greg Sheremeta: Verified; Looks good to me, but someone else must approve

-- 
To view, visit http://gerrit.ovirt.org/36367
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: I40f9a13105fe99bb6b4035e61b8945efd8315f57
Gerrit-PatchSet: 8
Gerrit-Project: ovirt-engine
Gerrit-Branch: master
Gerrit-Owner: Juan Hernandez <juan.hernandez@redhat.com>
Gerrit-Reviewer: Alexander Wels <awels@redhat.com>
Gerrit-Reviewer: Einav Cohen <ecohen@redhat.com>
Gerrit-Reviewer: Greg Sheremeta <gshereme@redhat.com>
Gerrit-Reviewer: Jenny Kang <jennykang95@gmail.com>
Gerrit-Reviewer: Juan Hernandez <juan.hernandez@redhat.com>
Gerrit-Reviewer: Vojtech Szocs <vszocs@redhat.com>
Gerrit-Reviewer: automation@ovirt.org
Gerrit-Reviewer: oVirt Jenkins CI Server

juan.hernandez＠redhat.com

tags

participants (1)