zaqar/doc/source/admin/CORS.rst

CORS Guide

Zaqar supports Cross-Origin Resource Sharing (CORS) now. The function is provided by oslo.middleware. Please see Official Doc and OpenStack Spec for more detail. This guide is mainly tell users how to use it in Zaqar.

New Config Options

There are some new config options.

allowed_origin

Indicate whether this resource may be shared with the domain received in the requests "origin" header. Format: "<protocol>://<host>[:<port>]", no trailing slash. Example: https://horizon.example.com'.

allow_credentials

Indicate that the actual request can include user credentials. The default value is True.

expose_headers

Indicate which headers are safe to expose to the API. Defaults to HTTP Simple Headers. The default value is [].

max_age

Maximum cache age of CORS preflight requests. The default value is 3600.

allow_methods

Indicate which methods can be used during the actual request. The default value is ['OPTIONS', 'GET', 'HEAD', 'POST', 'PUT', 'DELETE', 'TRACE', 'PATCH'].

allow_headers

Indicate which header field names may be used during the actual request. The default value is [].

Request and Response example

The CORS feature is enabled by default in Zaqar. Here is a config example::

[cors]
allowed_origin = http://example
allow_methods = GET

the above example config options mean that Zaqar only receive the GET request from http://example domain. Here are some example request: 1. Zaqar will do nothing if the request doesn't contain "Origin" header:

# curl -I -X GET http://10.229.47.217:8888 -H "Accept: application/json"

HTTP/1.1 300 Multiple Choices
content-length: 668
content-type: application/json; charset=UTF-8
Connection: close

2. Zaqar will return nothing in response headers if the "Origin" is not in allowed_origin:

# curl -I -X GET http://10.229.47.217:8888 -H "Accept: application/json" -H "Origin: http://"

HTTP/1.1 300 Multiple Choices
content-length: 668
content-type: application/json; charset=UTF-8
Connection: close

In the Zaqar log, we can see a message:

CORS request from origin 'http://' not permitted.

3. Zaqar will return CORS information if the "Origin" header is in allowed_origin:

# curl -I -X GET http://10.229.47.217:8888 -H "Accept: application/json" -H "Origin: http://example"

HTTP/1.1 300 Multiple Choices
content-length: 668
content-type: application/json; charset=UTF-8
Vary: Origin
Access-Control-Allow-Origin: http://example
Access-Control-Allow-Credentials: true
Connection: close

4. Zaqar will return more information if the request doesn't follow Zaqar'sCORS rule:

# curl -I -X PUT http://10.229.47.217:8888 -H "Accept: application/json" -H "Origin: http://example"
HTTP/1.1 405 Method Not Allowed
content-length: 0
content-type: application/json; charset=UTF-8
allow: GET, OPTIONS
Vary: Origin
Access-Control-Allow-Origin: http://example
Access-Control-Allow-Credentials: true
Connection: close