[ovirt-devel] CORS enabled for oVirt REST API

[Juan Hernández]

On 12/22/2014 04:46 PM, Jenny Kang wrote:
> Hello,
> 
> As part of my OPW project, I'm trying to build a mobile web UI for oVirt
> but I'm having some troubles.
> 
> I cannot access the oVirt REST API because it doesn't allow cross origin
> resource sharing (CORS). The only way to access the API is to host the
> UI on the same IP as the engine. If it is enabled then people would be
> able to run the mobile UI directly from the desktop without hosting it
> anywhere.
> 
> Do you have any suggestions on how to access oVirt REST API from another
> host inside the browser? Any plans on enabling CORS on the REST API?
> 
> Thank you!
> 
> Cheers
> Jenny
> 

There are no plans to enable CORS at the moment, basically because
nobody expressed interest on having it. Good to see that you do. Adding
CORS support to the RESTAPI shouldn't be that complicated, as there are
already fairly easy to use filters that can be used with little effort.
For example, you could use this one:

  https://github.com/ebay/cors-filter

To add it to the RESTAPI you need to create a JBoss module for it, add
it as a dependency, and activate it in the RESTAPI web.xml deployment
descriptor. Should be something like this:

  http://gerrit.ovirt.org/36367

Note that this is just an example. Adding this to the engine should be
done carefully. In particular we can't just enable CORS for every site,
as that would open the door for many attacks. If we add CORS it should
be only for a configurable restricted set of origins. It would be nice
if you can work in this direction.

Once you have this CORS support you should be able to use the RESTAPI
from your application. I'm attaching a simple example.

The alternative to CORS is to deploy your application in a web server
that also acts as a reverse proxy for the engine. That way your web
application and the proxied engine will have the same origin.

-- 
Dirección Comercial: C/Jose Bardasano Baos, 9, Edif. Gorbea 3, planta
3ºD, 28016 Madrid, Spain
Inscrita en el Reg. Mercantil de Madrid – C.I.F. B82657941 - Red Hat S.L.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ovirt.org/pipermail/devel/attachments/20141223/8802080e/attachment-0001.html>