1283292 - Enable CORS on Community Discourse for community sites

Status: RESOLVED FIXED

(Participation Infrastructure :: Community Ops, task)

Description

[Leo McArdle [:leo]]

CORS should be enabled on Discourse to allow http://arewediscoursingyet.com/ to access the json file of metrics

Comment 1

[Yousef Alam [:yalam96] (use NEEDINFO)]

Ops blog will also need this. Need to see why Discourse also sends the ACAC header when CORS is enabled.

Comment 2

[Rubén Martín [:Nukeador] ❌ [away till Aug 31st]]

I would love to have CORS back in order to fetch some topics from a campaign page we are creating :)

Comment 3

[Rubén Martín [:Nukeador] ❌ [away till Aug 31st]]

Do we have an ETA for this?

It's blocking any discourse integration with external sites/tools.

Comment 4

[Yousef Alam [:yalam96] (use NEEDINFO)]

We moved this out of our sprint for this and last week as other things came up. We're expecting to put this in our next sprint or the one after.

Comment 5

[Yousef Alam [:yalam96] (use NEEDINFO)]

Nuke, which domains should I enable in CORS for you?

Comment 6

[Rubén Martín [:Nukeador] ❌ [away till Aug 31st]]

Well, I was expecting CORS to be enabled for everyone, since this will allow people to play and test the API without asking for approval.

We wanted to experiment here http://activate.mozilla.community/

But I was also doing my personal tests here: 

https://www.nukeador.com/discourse-blog/ 
https://github.com/nukeador/discourse-api-js

Comment 7

[Yousef Alam [:yalam96] (use NEEDINFO)]

I've enabled CORS for the following domains:

https://arewediscoursingyet.com
https://activate.mozilla.community
https://nukeador.com
https://github.io

Comment 8

[Henrik Mitsch [:hmitsch]]

Hi Rubén,

the reason we cannot provide an "allow everyone for CORS" policy is because Discourse also adds an Access-Control-Allow-Credentials header which is wrong when the origin is * and a security risk otherwise.

However, we offer to add CORS configurations in a timely manner whenever people request them.

We hereby close the issue as the above mentioned sites have been CORS enabled.

Best regards,
   Henrik

Comment 9

[Rubén Martín [:Nukeador] ❌ [away till Aug 31st]]

Can we have it also for any *.mozilla.org or mozilla.community site?

Bug 1309226 will need it for mozilla.org

Comment 10

[Henrik Mitsch [:hmitsch]]

Hi Rubén,

we will address Bug 1309226 (https://tree.taiga.io/project/pierros-mozilla-particiaption-systems/us/197?kanban-status=904519) next year and will solve that issue in the most appropriate way.

Again, any site that wants to have access will be configured. This will happen on a case by case base. There is no wildcard configuration.

Hope this helps.

Best regards,
   Henrik