646636 - Allow cross-domain XHR requests on the self-serve API

Status: RESOLVED FIXED

(Release Engineering :: General, defect, P2)

Description

[(no longer active)]

+++ This bug was initially created as a clone of Bug #646487 +++

This is another thing that we need for integration of self-serve APIs with TBPL.

Comment 1

[Chris AtLee [:catlee]]

What's the exact header name/value you want?

Comment 2

[(no longer active)]

(In reply to comment #1)
> What's the exact header name/value you want?

Unfortunately because we need to send DELETE requests, we should support preflighted requests <https://developer.mozilla.org/En/HTTP_Access_Control#Preflighted_requests>.  This is a lot more complicated than I thought... :(

Comment 3

[Chris AtLee [:catlee]]

(In reply to comment #2)
> (In reply to comment #1)
> > What's the exact header name/value you want?
> 
> Unfortunately because we need to send DELETE requests, we should support
> preflighted requests
> <https://developer.mozilla.org/En/HTTP_Access_Control#Preflighted_requests>. 
> This is a lot more complicated than I thought... :(

You can send POST with a parameter _method=DELETE

Comment 4

[(no longer active)]

(In reply to comment #3)
> (In reply to comment #2)
> > (In reply to comment #1)
> > > What's the exact header name/value you want?
> > 
> > Unfortunately because we need to send DELETE requests, we should support
> > preflighted requests
> > <https://developer.mozilla.org/En/HTTP_Access_Control#Preflighted_requests>. 
> > This is a lot more complicated than I thought... :(
> 
> You can send POST with a parameter _method=DELETE

In that case, specifying this header should be all that is needed:

Access-Control-Allow-Origin: *

Comment 5

[Cameron McCormack (:heycam)]

We need to allow the user's HTTP credentials to be used when accessing the self-serve API.  By my reading of CORS, this means we need to send

  Access-Control-Allow-Origin: tbpl.mozilla.org
  Access-Control-Allow-Credentials: true

since it says you can't use "*" when making cross-origin requests with credentials.  That might be problematic for those running their own TBPL instances on different hosts.

Comment 6

[(no longer active)]

So, this might be stupid, but do we want to look at the Referer header (if set by the browser) and set Access-Control-Allow-Origin based on the hostname in use (and fall back to tbpl.m.o if it's not set)?

Comment 7

[Cameron McCormack (:heycam)]

Would that mean anyone could write a page that could cancel/trigger builds using the user's current credentials?  Seems like that might be a problem, so I think it would be better to whitelist people's individual tbpl variants.

Comment 8

[Cameron McCormack (:heycam)]

I propose the following headers be sent by the self-serve API pages:

  Access-Control-Allow-Origin: tbpl.mozilla.org, tests.themasta.com, dev.philringnalda.com, bbpl.dbaron.org, tbpl.mcc.id.au
  Access-Control-Allow-Credentials: true

They're the TBPL instances I'm aware of.  (The last one is where I'm testing bug 634915 work, which needs this cross-domain access.)

Comment 9

[Cameron McCormack (:heycam)]

Sorry, should be this:

  Access-Control-Allow-Origin: http://tbpl.mozilla.org http://tests.themasta.com http://dev.philringnalda.com http://bbpl.dbaron.org http://tbpl.mcc.id.au
  Access-Control-Allow-Credentials: true

Comment 10

[(no longer active)]

(In reply to comment #9)
> Sorry, should be this:
> 
>   Access-Control-Allow-Origin: http://tbpl.mozilla.org
> http://tests.themasta.com http://dev.philringnalda.com http://bbpl.dbaron.org
> http://tbpl.mcc.id.au
>   Access-Control-Allow-Credentials: true

If that's how we should be playing, please add http://ehsanakhgari.org too.

Comment 11

[Chris AtLee [:catlee]]

Attachment: Add ControlHeaders middleware

Comment 12

[Chris AtLee [:catlee]]

Comment on attachment 525793 [details] [diff] [review]
Add ControlHeaders middleware

http://hg.mozilla.org/build/buildapi/rev/529092a87932