Ensure that CORS is configured properly

[masaball]

After pushing the CORS changes to the demo site we are still encountering problems when attempting to use IIIF manifests in external services. Checking the network tab and the console, the access-control-allow-origin header is being set properly. It is reflecting the external service that the IIIF manifest is being loaded into. However, we are missing another header that is apparently necessary: access-control-allow-credentials.

The error seen is "Access to XMLHttpRequest from origin has been blocked by CORS policy: The value of the 'Access-Control-Allow-Credentials' header in the response is '' which must be 'true' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute."

We may need to enable the Access-Control-Allow-Credentials header in Rack::CORS. This would be an unsafe configuration though. I am unsure of the XMLHttpRequest, but if that's from our application we can set the withCredentials attribute to false. I think that would break authentication and possibly other behavior though.

Need to investigate the best approach for this and determine the actual level of risk involved in the solutions.

[joncameron]

UV requires this, but there are potential security risks. It would be ideal to have documentation on these risks.

Should we also check in with UV about this configuration? UV devs had originally pointed this out to us. We could reach out and get clarity.

[masaball]

Notes: https://docs.google.com/document/d/1o_qdCvz8NpdlEv_5CyaPffUGJvVQDYAn4XG5reyhS8Q/edit?usp=sharing

[elynema]

Tested with this manifest in UV. Manifest content loading, but not video content. Manifest itself is indicating some auth issues. @joncameron Can you test also?

[joncameron]

I found the same as Emily with this manifest in UV. I'm getting this error in the console:
Uncaught SyntaxError: JSON.parse: unexpected character at line 1 column 1 of the JSON data

[joncameron]

This was probably due to a bad record (^) and other testing looks good so I'm going to close this issue.