-
-
Notifications
You must be signed in to change notification settings - Fork 4.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CORS: Add OCS-APIRequest header to allowed headers in OCSController #31694
Labels
Comments
everlanes
added
0. Needs triage
Pending check for reproducibility or if it fits our roadmap
enhancement
labels
Mar 24, 2022
everlanes
added a commit
to everlanes/forms
that referenced
this issue
Mar 24, 2022
When accessing the OCS API the header `OCS-APIRequest: true` must be set. Otherwise the request is refused. When accessing the API with a XMLHttpRequest in a browser, the browser performs a CORS preflight check and is verifying, that all extra headers are allowed by the endpoint in this request. When the `OCS-APIRequest` header is missing in this list, the browser refuses to perform the API call for security reasons. This change is needed as a lokal fix in the Nextcloud Forms API. If the OCS-APIRequest header is added to the OCSController in the Nextcloud Server repository, this fix is no longer needed (see Issue nextcloud/server#31694).
everlanes
added a commit
to everlanes/forms
that referenced
this issue
Mar 25, 2022
When accessing the OCS API the header `OCS-APIRequest: true` must be set. Otherwise the request is refused. When accessing the API with a XMLHttpRequest in a browser, the browser performs a CORS preflight check and is verifying, that all extra headers are allowed by the endpoint in this request. When the `OCS-APIRequest` header is missing in this list, the browser refuses to perform the API call for security reasons. This change is needed as a lokal fix in the Nextcloud Forms API. If the OCS-APIRequest header is added to the OCSController in the Nextcloud Server repository, this fix is no longer needed (see Issue nextcloud/server#31694). Signed-off-by: Andreas Brinner <[email protected]>
jotoeri
added
bug
and removed
enhancement
0. Needs triage
Pending check for reproducibility or if it fits our roadmap
labels
Dec 21, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
How to use GitHub
Is your feature request related to a problem? Please describe.
I tried to call the OCS api from an external website with a XMLHttpRequest request.
Chrome prevents this with the following error:
Access to XMLHttpRequest at '.../ocs/v2.php/apps/forms/api/v1.1/submission/insert' from origin 'http://127.0.0.1:8000' has been blocked by CORS policy: Request header field ocs-apirequest is not allowed by Access-Control-Allow-Headers in preflight response.
Describe the solution you'd like
I would suggest, to add this header permanently to the list of allowed headers in the OCSController constructor, making it easier to use the OCS api in 3rd party websites apps.
Describe alternatives you've considered
I can prevent the error and satisfy Chrome preflight check, by modifying the forms app ApiController. Adding
ocs-apirequest
to the list of allowed headers in the constructor call of the OCSController solves the problem.So I am quite sure, this solution is working.
But, as I understand, the OCS API always requires the
OCS-APIRequest
header. That is why I would prefer to add this header to the OCSController generally.The text was updated successfully, but these errors were encountered: