1345163 - Serve webapi CORS header from Tornado instead of nginx

Status: RESOLVED FIXED

(Conduit :: General, enhancement)

Description

[Israel Madueme [:imadueme]]

Having the API handle CORS gives us more fine grain control.

Comment 1

[Israel Madueme [:imadueme]]

Attachment: autoland-webapi: add cors headers to public api paths from config option (bug 1345163).

Added a base RequestHandler for the public api routes that will set
the 'Access-Control-Allow-Origin' to allow requests from the UI
origin, where ever it may be. This is controlled by the 'cors_allowed_origins'
option when the app is created. If cors_allowed_origins is unset or empty
then no CORS header will be set, thus not allowing any requests from any
other origin.

Review commit: https://reviewboard.mozilla.org/r/117930/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/117930/

Comment 2

[Israel Madueme [:imadueme]]

Comment on attachment 8844536 [details]
autoland-webapi: add cors headers to public api paths from config option (bug 1345163).

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/117930/diff/1-2/

Comment 3

[Steven MacLeod [:smacleod]]

Comment on attachment 8844536 [details]
autoland-webapi: add cors headers to public api paths from config option (bug 1345163).

https://reviewboard.mozilla.org/r/117930/#review120000

LGTM

::: autoland/webapi/autolandweb/routes.py:12
(Diff revision 2)
>  
>  from autolandweb.dockerflow import DOCKERFLOW_ROUTES
>  from autolandweb.series import get_series_status
>  
>  
> -class MainHandler(tornado.web.RequestHandler):
> +class PublicApiHandler(tornado.web.RequestHandler):

I think we'll probably have to setup the preflight "OPTIONS" response in the base handler, but it's not needed yet since we only have get. Just putting this here so we remember.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/automation/conduit/rev/a15151d3b573
autoland-webapi: add cors headers to public api paths from config option . r=smacleod