Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CORS: Add OCS-APIRequest header to allowed headers in OCSController #31694

Closed
everlanes opened this issue Mar 24, 2022 · 1 comment
Closed

CORS: Add OCS-APIRequest header to allowed headers in OCSController #31694

everlanes opened this issue Mar 24, 2022 · 1 comment
Labels

Comments

@everlanes
Copy link
Contributor

everlanes commented Mar 24, 2022

How to use GitHub

  • Please use the 👍 reaction to show that you are interested into the same feature.
  • Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
  • Subscribe to receive notifications on status change and new comments.

Is your feature request related to a problem? Please describe.
I tried to call the OCS api from an external website with a XMLHttpRequest request.

Chrome prevents this with the following error:
Access to XMLHttpRequest at '.../ocs/v2.php/apps/forms/api/v1.1/submission/insert' from origin 'http://127.0.0.1:8000' has been blocked by CORS policy: Request header field ocs-apirequest is not allowed by Access-Control-Allow-Headers in preflight response.

Describe the solution you'd like
I would suggest, to add this header permanently to the list of allowed headers in the OCSController constructor, making it easier to use the OCS api in 3rd party websites apps.

public function __construct($appName,
	IRequest $request,
	$corsMethods = 'PUT, POST, GET, DELETE, PATCH',
	$corsAllowedHeaders = 'Authorization, Content-Type, Accept, OCS-APIRequest',
	$corsMaxAge = 1728000) {

Describe alternatives you've considered
I can prevent the error and satisfy Chrome preflight check, by modifying the forms app ApiController. Adding ocs-apirequest to the list of allowed headers in the constructor call of the OCSController solves the problem.

So I am quite sure, this solution is working.

But, as I understand, the OCS API always requires the OCS-APIRequest header. That is why I would prefer to add this header to the OCSController generally.

@everlanes everlanes added 0. Needs triage Pending check for reproducibility or if it fits our roadmap enhancement labels Mar 24, 2022
everlanes added a commit to everlanes/forms that referenced this issue Mar 24, 2022
When accessing the OCS API the header `OCS-APIRequest: true` must be set.
Otherwise the request is refused.

When accessing the API with a XMLHttpRequest in a browser, the browser performs a CORS preflight check and is verifying, that all extra headers are allowed by the endpoint in this request. When the `OCS-APIRequest` header is missing in this list, the browser refuses to perform the API call for security reasons.

This change is needed as a lokal fix in the Nextcloud Forms API. If the OCS-APIRequest header is added to the OCSController in the Nextcloud Server repository, this fix is no longer needed (see Issue nextcloud/server#31694).
everlanes added a commit to everlanes/forms that referenced this issue Mar 25, 2022
When accessing the OCS API the header `OCS-APIRequest: true` must be set.
Otherwise the request is refused.

When accessing the API with a XMLHttpRequest in a browser, the browser performs a CORS preflight check and is verifying, that all extra headers are allowed by the endpoint in this request. When the `OCS-APIRequest` header is missing in this list, the browser refuses to perform the API call for security reasons.

This change is needed as a lokal fix in the Nextcloud Forms API. If the OCS-APIRequest header is added to the OCSController in the Nextcloud Server repository, this fix is no longer needed (see Issue nextcloud/server#31694).

Signed-off-by: Andreas Brinner <[email protected]>
@jotoeri
Copy link
Member

jotoeri commented Dec 21, 2022

#31807

@jotoeri jotoeri closed this as completed Dec 21, 2022
@jotoeri jotoeri added bug and removed enhancement 0. Needs triage Pending check for reproducibility or if it fits our roadmap labels Dec 21, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants