Cannot load profiles from bugzilla without manually downloading them because of CORS
Categories
(bugzilla.mozilla.org :: General, enhancement)
Tracking
()
People
(Reporter: emilio, Unassigned)
Details
Somebody attached a profile to bug 1580969.
I expected to be able to just go to https://profiler.firefox.com, load from URL, and paste the attachment URL.
But instead doing that I get an error:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://bug1580969.bmoattachments.org/attachment.cgi?id=9092485. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).
Would it be possible to make public bugzilla attachments available to other websites?
|
||
Comment 1•7 years ago
|
||
I personally cannot see a reason why this would be a problem. May be good to get someone from security to
vouch for this change. dveditz, we have code in place to keep unauthorized people from viewing private
attachments already, so just allowing a non-same-origin client to load a bmo attachment should be safe
enough IMO. It should be as simple as adding the following to each attachment request:
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Thoughts?
|
||
Comment 2•7 years ago
|
||
ACAO: * will only help if the CORS request does not send cookies. This makes it safe because website devs can't accidentally give up private data. By default cross-site CORS requests don't send cookies (the web page has to explicitly turn them on) so I assume that's the profiler.firefox.com behavior. If the request on the BMO side actually requires cookies to work even if you're not logged in (I don't know if the redirect-dance uses them) then doing that won't help the CORS problem.
we have code in place to keep unauthorized people from viewing private attachments already, so just allowing a non-same-origin client to load a bmo attachment should be safe enough IMO.
The problem CORS is trying to address is when an evil site takes advantage of the fact that a user is authorized on the target site. So if you use something other than "*" (the naïve approach is to echo the requesting origin back in the ACAO header uncritically) any site can try to slurp down all the things that user can see. For this situation you'd have to whitelist https://profiler.firefox.com as a site you are willing to trust to handle sensitive data correctly. No disrespect to that team, but I'm not willing to go there without a security review of any security controls they might have around this functionality and who can modify their code repo. So that leads back to the original request: in addition to slapping on an ACAO header you'd have to check to make sure the requested content was not part of any restricted groups before doing so.
So I hope Access-Control-Allow-Origin: * works and if it does go for it. Otherwise it's not just a "simple" request.
Description
•