| Summary: | Add ability to set CORS header in Koha | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Kyle M Hall (khall) <kyle> |
| Component: | Web services | Assignee: | Tomás Cohen Arazi (tcohen) <tomascohen> |
| Status: | CLOSED FIXED | QA Contact: | |
| Severity: | new feature | ||
| Priority: | P5 - low | CC: | 1joynelson, benjamin.rokseth, dcook, kyle, martin.renvoize, nick |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: |
This development adds support for setting the Access-Control-Allow-Origin header in Koha using the new AccessControlAllowOrigin system preference. This is especially useful for integrating data from the services provided by Koha on sites other than Koha itself.
**New system preference**: `AccessControlAllowOrigin` defaults to empty.
|
Version(s) released in: |
20.05.00
|
| Circulation function: | |||
| Bug Depends on: | |||
| Bug Blocks: | 24384 | ||
| Attachments: |
Bug 24369: Add AccessControlAllowOrigin syspref
Bug 24369: Add CORS support to output_with_http_headers() Bug 24369: Add CORS support to the API Bug 24369: Add AccessControlAllowOrigin syspref Bug 24369: Add CORS support to output_with_http_headers() Bug 24369: Add CORS support to the API Bug 24369: Add AccessControlAllowOrigin syspref Bug 24369: Add CORS support to output_with_http_headers() Bug 24369: Add CORS support to the API |
||
|
Description
Kyle M Hall (khall)
2020-01-07 17:26:45 UTC
There are two APIs actually that could benefit from this: - /svc - /api/v1 Created attachment 97092 [details] [review] Bug 24369: Add AccessControlAllowOrigin syspref Created attachment 97093 [details] [review] Bug 24369: Add CORS support to output_with_http_headers() This patch adds CORS support to output_with_headers(). It will use the AccessControlAllowOrigin syspref to pick the value and set the Access-Control-Allow-Origin header. To test: 1. Apply this patch 2. Run: $ kshell k$ prove t/Output.t SUCCESS: Tests pass! 3. Sign off :-D Created attachment 97094 [details] [review] Bug 24369: Add CORS support to the API This patch adds CORS support for API requests. It uses the AccessControlAllowOrigin syspref. To test: 1. Apply this patch 2. Run: $ kshell k$ prove t/db_dependent/api/v1/auth.t => SUCCESS: Tests pass! 3. Set the AccessControlAllowOrigin to any string (for example, *) 4. Use any API testing tool (Postman?) to place a request on the API => SUCCESS: The response headers include Access-Control-Allow-Origin, containing what you set on the syspref 5. Sign off :-D Created attachment 97298 [details] [review] Bug 24369: Add AccessControlAllowOrigin syspref Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com> Created attachment 97299 [details] [review] Bug 24369: Add CORS support to output_with_http_headers() This patch adds CORS support to output_with_headers(). It will use the AccessControlAllowOrigin syspref to pick the value and set the Access-Control-Allow-Origin header. To test: 1. Apply this patch 2. Run: $ kshell k$ prove t/Output.t SUCCESS: Tests pass! 3. Sign off :-D Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com> Created attachment 97300 [details] [review] Bug 24369: Add CORS support to the API This patch adds CORS support for API requests. It uses the AccessControlAllowOrigin syspref. To test: 1. Apply this patch 2. Run: $ kshell k$ prove t/db_dependent/api/v1/auth.t => SUCCESS: Tests pass! 3. Set the AccessControlAllowOrigin to any string (for example, *) 4. Use any API testing tool (Postman?) to place a request on the API => SUCCESS: The response headers include Access-Control-Allow-Origin, containing what you set on the syspref 5. Sign off :-D Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com> Created attachment 100144 [details] [review] Bug 24369: Add AccessControlAllowOrigin syspref Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 100145 [details] [review] Bug 24369: Add CORS support to output_with_http_headers() This patch adds CORS support to output_with_headers(). It will use the AccessControlAllowOrigin syspref to pick the value and set the Access-Control-Allow-Origin header. To test: 1. Apply this patch 2. Run: $ kshell k$ prove t/Output.t SUCCESS: Tests pass! 3. Sign off :-D Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 100146 [details] [review] Bug 24369: Add CORS support to the API This patch adds CORS support for API requests. It uses the AccessControlAllowOrigin syspref. To test: 1. Apply this patch 2. Run: $ kshell k$ prove t/db_dependent/api/v1/auth.t => SUCCESS: Tests pass! 3. Set the AccessControlAllowOrigin to any string (for example, *) 4. Use any API testing tool (Postman?) to place a request on the API => SUCCESS: The response headers include Access-Control-Allow-Origin, containing what you set on the syspref 5. Sign off :-D Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Nice work everyone! Pushed to master for 20.05 Interesting approach! I was surprised you didn't handle it at the reverse proxy level, but interesting to allow libraries to configure their own header. (In reply to David Cook from comment #12) > Interesting approach! I was surprised you didn't handle it at the reverse > proxy level, but interesting to allow libraries to configure their own > header. On small shops, it's easier to just carry the config from the DB and use stock configurations for the rest of the stack. Power to the users! (In reply to Tomás Cohen Arazi from comment #13) > > On small shops, it's easier to just carry the config from the DB and use > stock configurations for the rest of the stack. Power to the users! Yeah it's interesting! Honestly, the more time goes by, the more carrying config from the DB makes sense. Much easier than trying to mess with a bunch of files. enhancement not backported to 19.11.x |