Bug 24369 - Add ability to set CORS header in Koha
Summary: Add ability to set CORS header in Koha
Status: Pushed to master
Alias: None
Product: Koha
Classification: Unclassified
Component: Web services (show other bugs)
Version: master
Hardware: All All
: P5 - low new feature with 10 votes (vote)
Assignee: Tomás Cohen Arazi
QA Contact:
URL:
Keywords:
Depends on:
Blocks: 24384
  Show dependency treegraph
 
Reported: 2020-01-07 17:26 UTC by Kyle M Hall
Modified: 2020-05-20 08:56 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Who signed the patch off:
Text to go in the release notes:
This development adds support for setting the Access-Control-Allow-Origin header in Koha using the new AccessControlAllowOrigin system preference. This is especially useful for integrating data from the services provided by Koha on sites other than Koha itself. **New system preference**: `AccessControlAllowOrigin` defaults to empty.
Version(s) released in:
20.05.00


Attachments
Bug 24369: Add AccessControlAllowOrigin syspref (2.77 KB, patch)
2020-01-09 14:22 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 24369: Add CORS support to output_with_http_headers() (3.77 KB, patch)
2020-01-09 14:22 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 24369: Add CORS support to the API (2.99 KB, patch)
2020-01-09 14:23 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 24369: Add AccessControlAllowOrigin syspref (2.86 KB, patch)
2020-01-13 10:39 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 24369: Add CORS support to output_with_http_headers() (3.84 KB, patch)
2020-01-13 10:39 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 24369: Add CORS support to the API (3.05 KB, patch)
2020-01-13 10:39 UTC, Andrew Isherwood
Details | Diff | Splinter Review
Bug 24369: Add AccessControlAllowOrigin syspref (2.91 KB, patch)
2020-03-04 18:41 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 24369: Add CORS support to output_with_http_headers() (3.91 KB, patch)
2020-03-04 18:41 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 24369: Add CORS support to the API (3.12 KB, patch)
2020-03-04 18:41 UTC, Kyle M Hall
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Kyle M Hall 2020-01-07 17:26:45 UTC
The reports API can produce JSON that would be useful on other library related websites, but the use of it appears to be blocked by default via CORS. It would be nice if there were a Koha syspref to set the CORS header rather than mucking about with htaccess files and whatnot.
Comment 1 Tomás Cohen Arazi 2020-01-07 17:39:18 UTC
There are two APIs actually that could benefit from this:
- /svc
- /api/v1
Comment 2 Tomás Cohen Arazi 2020-01-09 14:22:54 UTC
Created attachment 97092 [details] [review]
Bug 24369: Add AccessControlAllowOrigin syspref
Comment 3 Tomás Cohen Arazi 2020-01-09 14:22:57 UTC
Created attachment 97093 [details] [review]
Bug 24369: Add CORS support to output_with_http_headers()

This patch adds CORS support to output_with_headers(). It will use the
AccessControlAllowOrigin syspref to pick the value and set the Access-Control-Allow-Origin header.

To test:
1. Apply this patch
2. Run:
   $ kshell
  k$ prove t/Output.t
SUCCESS: Tests pass!
3. Sign off :-D
Comment 4 Tomás Cohen Arazi 2020-01-09 14:23:01 UTC
Created attachment 97094 [details] [review]
Bug 24369: Add CORS support to the API

This patch adds CORS support for API requests. It uses the
AccessControlAllowOrigin syspref. To test:

1. Apply this patch
2. Run:
   $ kshell
  k$ prove t/db_dependent/api/v1/auth.t
=> SUCCESS: Tests pass!
3. Set the AccessControlAllowOrigin to any string (for example, *)
4. Use any API testing tool (Postman?) to place a request on the API
=> SUCCESS: The response headers include Access-Control-Allow-Origin,
    containing what you set on the syspref
5. Sign off :-D
Comment 5 Andrew Isherwood 2020-01-13 10:39:21 UTC
Created attachment 97298 [details] [review]
Bug 24369: Add AccessControlAllowOrigin syspref

Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>
Comment 6 Andrew Isherwood 2020-01-13 10:39:23 UTC
Created attachment 97299 [details] [review]
Bug 24369: Add CORS support to output_with_http_headers()

This patch adds CORS support to output_with_headers(). It will use the
AccessControlAllowOrigin syspref to pick the value and set the Access-Control-Allow-Origin header.

To test:
1. Apply this patch
2. Run:
   $ kshell
  k$ prove t/Output.t
SUCCESS: Tests pass!
3. Sign off :-D

Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>
Comment 7 Andrew Isherwood 2020-01-13 10:39:27 UTC
Created attachment 97300 [details] [review]
Bug 24369: Add CORS support to the API

This patch adds CORS support for API requests. It uses the
AccessControlAllowOrigin syspref. To test:

1. Apply this patch
2. Run:
   $ kshell
  k$ prove t/db_dependent/api/v1/auth.t
=> SUCCESS: Tests pass!
3. Set the AccessControlAllowOrigin to any string (for example, *)
4. Use any API testing tool (Postman?) to place a request on the API
=> SUCCESS: The response headers include Access-Control-Allow-Origin,
    containing what you set on the syspref
5. Sign off :-D

Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>
Comment 8 Kyle M Hall 2020-03-04 18:41:17 UTC
Created attachment 100144 [details] [review]
Bug 24369: Add AccessControlAllowOrigin syspref

Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 9 Kyle M Hall 2020-03-04 18:41:25 UTC
Created attachment 100145 [details] [review]
Bug 24369: Add CORS support to output_with_http_headers()

This patch adds CORS support to output_with_headers(). It will use the
AccessControlAllowOrigin syspref to pick the value and set the Access-Control-Allow-Origin header.

To test:
1. Apply this patch
2. Run:
   $ kshell
  k$ prove t/Output.t
SUCCESS: Tests pass!
3. Sign off :-D

Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 10 Kyle M Hall 2020-03-04 18:41:28 UTC
Created attachment 100146 [details] [review]
Bug 24369: Add CORS support to the API

This patch adds CORS support for API requests. It uses the
AccessControlAllowOrigin syspref. To test:

1. Apply this patch
2. Run:
   $ kshell
  k$ prove t/db_dependent/api/v1/auth.t
=> SUCCESS: Tests pass!
3. Set the AccessControlAllowOrigin to any string (for example, *)
4. Use any API testing tool (Postman?) to place a request on the API
=> SUCCESS: The response headers include Access-Control-Allow-Origin,
    containing what you set on the syspref
5. Sign off :-D

Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 11 Martin Renvoize 2020-03-05 13:06:18 UTC
Nice work everyone!

Pushed to master for 20.05
Comment 12 David Cook 2020-03-05 23:37:46 UTC
Interesting approach! I was surprised you didn't handle it at the reverse proxy level, but interesting to allow libraries to configure their own header.
Comment 13 Tomás Cohen Arazi 2020-03-05 23:55:36 UTC
(In reply to David Cook from comment #12)
> Interesting approach! I was surprised you didn't handle it at the reverse
> proxy level, but interesting to allow libraries to configure their own
> header.

On small shops, it's easier to just carry the config from the DB and use stock configurations for the rest of the stack. Power to the users!
Comment 14 David Cook 2020-03-06 00:38:18 UTC
(In reply to Tomás Cohen Arazi from comment #13)
> 
> On small shops, it's easier to just carry the config from the DB and use
> stock configurations for the rest of the stack. Power to the users!

Yeah it's interesting! Honestly, the more time goes by, the more carrying config from the DB makes sense. Much easier than trying to mess with a bunch of files.
Comment 15 Joy Nelson 2020-04-01 22:10:04 UTC
enhancement not backported to 19.11.x