Bug 24369 - Add ability to set CORS header in Koha
Summary: Add ability to set CORS header in Koha
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Web services (show other bugs)
Version: Main
Hardware: All All
: P5 - low new feature
Assignee: Tomás Cohen Arazi (tcohen)
QA Contact:
URL:
Keywords:
Depends on:
Blocks: 24384
  Show dependency tree / graph
 
Reported: 2020-01-07 17:26 UTC by Kyle M Hall (khall)
Modified: 2022-11-11 10:35 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
This development adds support for setting the Access-Control-Allow-Origin header in Koha using the new AccessControlAllowOrigin system preference. This is especially useful for integrating data from the services provided by Koha on sites other than Koha itself. **New system preference**: `AccessControlAllowOrigin` defaults to empty.
Version(s) released in:
20.05.00
Circulation function:

Attachments
Bug 24369: Add AccessControlAllowOrigin syspref (2.77 KB, patch)
2020-01-09 14:22 UTC, Tomás Cohen Arazi (tcohen) 		Details | Diff | Splinter Review
Bug 24369: Add CORS support to output_with_http_headers() (3.77 KB, patch)
2020-01-09 14:22 UTC, Tomás Cohen Arazi (tcohen) 		Details | Diff | Splinter Review
Bug 24369: Add CORS support to the API (2.99 KB, patch)
2020-01-09 14:23 UTC, Tomás Cohen Arazi (tcohen) 		Details | Diff | Splinter Review
Bug 24369: Add AccessControlAllowOrigin syspref (2.86 KB, patch)
2020-01-13 10:39 UTC, Andrew Isherwood 		Details | Diff | Splinter Review
Bug 24369: Add CORS support to output_with_http_headers() (3.84 KB, patch)
2020-01-13 10:39 UTC, Andrew Isherwood 		Details | Diff | Splinter Review
Bug 24369: Add CORS support to the API (3.05 KB, patch)
2020-01-13 10:39 UTC, Andrew Isherwood 		Details | Diff | Splinter Review
Bug 24369: Add AccessControlAllowOrigin syspref (2.91 KB, patch)
2020-03-04 18:41 UTC, Kyle M Hall (khall) 		Details | Diff | Splinter Review
Bug 24369: Add CORS support to output_with_http_headers() (3.91 KB, patch)
2020-03-04 18:41 UTC, Kyle M Hall (khall) 		Details | Diff | Splinter Review
Bug 24369: Add CORS support to the API (3.12 KB, patch)
2020-03-04 18:41 UTC, Kyle M Hall (khall) 		Details | Diff | Splinter Review
Show Obsolete (6) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Kyle M Hall (khall) 2020-01-07 17:26:45 UTC 
The reports API can produce JSON that would be useful on other library related websites, but the use of it appears to be blocked by default via CORS. It would be nice if there were a Koha syspref to set the CORS header rather than mucking about with htaccess files and whatnot.
Comment 1 Tomás Cohen Arazi (tcohen) 2020-01-07 17:39:18 UTC 
There are two APIs actually that could benefit from this:
- /svc
- /api/v1
Comment 2 Tomás Cohen Arazi (tcohen) 2020-01-09 14:22:54 UTC 
Created attachment 97092 [details] [review]
Bug 24369: Add AccessControlAllowOrigin syspref
Comment 3 Tomás Cohen Arazi (tcohen) 2020-01-09 14:22:57 UTC 
Created attachment 97093 [details] [review]
Bug 24369: Add CORS support to output_with_http_headers()

This patch adds CORS support to output_with_headers(). It will use the
AccessControlAllowOrigin syspref to pick the value and set the Access-Control-Allow-Origin header.

To test:
1. Apply this patch
2. Run:
   $ kshell
  k$ prove t/Output.t
SUCCESS: Tests pass!
3. Sign off :-D
Comment 4 Tomás Cohen Arazi (tcohen) 2020-01-09 14:23:01 UTC 
Created attachment 97094 [details] [review]
Bug 24369: Add CORS support to the API

This patch adds CORS support for API requests. It uses the
AccessControlAllowOrigin syspref. To test:

1. Apply this patch
2. Run:
   $ kshell
  k$ prove t/db_dependent/api/v1/auth.t
=> SUCCESS: Tests pass!
3. Set the AccessControlAllowOrigin to any string (for example, *)
4. Use any API testing tool (Postman?) to place a request on the API
=> SUCCESS: The response headers include Access-Control-Allow-Origin,
    containing what you set on the syspref
5. Sign off :-D
Comment 5 Andrew Isherwood 2020-01-13 10:39:21 UTC 
Created attachment 97298 [details] [review]
Bug 24369: Add AccessControlAllowOrigin syspref

Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>
Comment 6 Andrew Isherwood 2020-01-13 10:39:23 UTC 
Created attachment 97299 [details] [review]
Bug 24369: Add CORS support to output_with_http_headers()

This patch adds CORS support to output_with_headers(). It will use the
AccessControlAllowOrigin syspref to pick the value and set the Access-Control-Allow-Origin header.

To test:
1. Apply this patch
2. Run:
   $ kshell
  k$ prove t/Output.t
SUCCESS: Tests pass!
3. Sign off :-D

Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>
Comment 7 Andrew Isherwood 2020-01-13 10:39:27 UTC 
Created attachment 97300 [details] [review]
Bug 24369: Add CORS support to the API

This patch adds CORS support for API requests. It uses the
AccessControlAllowOrigin syspref. To test:

1. Apply this patch
2. Run:
   $ kshell
  k$ prove t/db_dependent/api/v1/auth.t
=> SUCCESS: Tests pass!
3. Set the AccessControlAllowOrigin to any string (for example, *)
4. Use any API testing tool (Postman?) to place a request on the API
=> SUCCESS: The response headers include Access-Control-Allow-Origin,
    containing what you set on the syspref
5. Sign off :-D

Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>
Comment 8 Kyle M Hall (khall) 2020-03-04 18:41:17 UTC 
Created attachment 100144 [details] [review]
Bug 24369: Add AccessControlAllowOrigin syspref

Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 9 Kyle M Hall (khall) 2020-03-04 18:41:25 UTC 
Created attachment 100145 [details] [review]
Bug 24369: Add CORS support to output_with_http_headers()

This patch adds CORS support to output_with_headers(). It will use the
AccessControlAllowOrigin syspref to pick the value and set the Access-Control-Allow-Origin header.

To test:
1. Apply this patch
2. Run:
   $ kshell
  k$ prove t/Output.t
SUCCESS: Tests pass!
3. Sign off :-D

Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 10 Kyle M Hall (khall) 2020-03-04 18:41:28 UTC 
Created attachment 100146 [details] [review]
Bug 24369: Add CORS support to the API

This patch adds CORS support for API requests. It uses the
AccessControlAllowOrigin syspref. To test:

1. Apply this patch
2. Run:
   $ kshell
  k$ prove t/db_dependent/api/v1/auth.t
=> SUCCESS: Tests pass!
3. Set the AccessControlAllowOrigin to any string (for example, *)
4. Use any API testing tool (Postman?) to place a request on the API
=> SUCCESS: The response headers include Access-Control-Allow-Origin,
    containing what you set on the syspref
5. Sign off :-D

Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 11 Martin Renvoize (ashimema) 2020-03-05 13:06:18 UTC 
Nice work everyone!

Pushed to master for 20.05
Comment 12 David Cook 2020-03-05 23:37:46 UTC 
Interesting approach! I was surprised you didn't handle it at the reverse proxy level, but interesting to allow libraries to configure their own header.
Comment 13 Tomás Cohen Arazi (tcohen) 2020-03-05 23:55:36 UTC 
(In reply to David Cook from comment #12)
> Interesting approach! I was surprised you didn't handle it at the reverse
> proxy level, but interesting to allow libraries to configure their own
> header.

On small shops, it's easier to just carry the config from the DB and use stock configurations for the rest of the stack. Power to the users!
Comment 14 David Cook 2020-03-06 00:38:18 UTC 
(In reply to Tomás Cohen Arazi from comment #13)
> 
> On small shops, it's easier to just carry the config from the DB and use
> stock configurations for the rest of the stack. Power to the users!

Yeah it's interesting! Honestly, the more time goes by, the more carrying config from the DB makes sense. Much easier than trying to mess with a bunch of files.
Comment 15 Joy Nelson 2020-04-01 22:10:04 UTC 
enhancement not backported to 19.11.x