Change CORS default pattern?

[mdavidsaver]

Could the default CORS list be changed to *?

phoebus-olog/src/main/resources/application.properties

Lines 143 to 147 in 02cf56c

	############################## CORS settings ##############################
	# Comma separated list of origins allowed to do CORS requests.
	# Defaults to http://localhost:3000 (NodeJS development), but must be augmented
	# with the origin(s) on which the web front-end is deployed.
	#cors.allowed.origins=http://localhost:3000

phoebus-olog/src/main/java/org/phoebus/olog/FileUploadSizeExceededHandler.java

Lines 43 to 48 in 02cf56c

	/**
	* Specifies the allowed origins for CORS requests. Defaults to http://localhost:3000,
	* which is useful during development of the web front-end in NodeJS.
	*/
	@Value("${cors.allowed.origins:http://localhost:3000}")
	private String corsAllowedOrigins;

phoebus-olog/src/main/java/org/phoebus/olog/FileUploadSizeExceededHandler.java

Line 55 in 02cf56c

headers.add("Access-Control-Allow-Origin", corsAllowedOrigins);

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Origin

[georgweiss]

@mdavidsaver, sorry, missed this.
Why not, will consider this shortly.

[georgweiss]

@mdavidsaver, I do not claim to ask a clever question, but would not a default value of * pose a potential security risk?

[mdavidsaver]

... default value of * pose a potential security risk?

Clearly the most secure default is to reject all requests. I hope can agree that such a choice would be less than helpful, and can consider compromises?

fyi. Where I was tripped up by this CORS default was with the olog web client. Presumably the regular phoebus client ignores the CORS headers?

[wanglin86769]

To share my humble experience, CORS only affects scripts running in web browsers, other REST clients like Node.js or Postman does not have such limitations.

In addition, as for CORS settings, it refers to the machine where the Olog web client is deployed (Apache or Nginx), not the one where user web browser is running.

[georgweiss]

Correct, the Phoebus Olog client does not load the web app, it just dispatches requests to the API endpoints. So there are no headers to consider.

@mdavidsaver, how was the Olog web client deployed? If deployed on Apache, configured with reverse proxy directives to the service, the current default is not an issue.

[mdavidsaver]

how was the Olog web client deployed?

As described here. I do not believe a reverse proxy is used. This was a very small installation without internet access.

[georgweiss]

Indeed looks like reverse proxy is not used.

Using npm as the front-end server (i.e. from which the web app is served) has been assumed to be the setup for development only, hence the setting cors.allowed.origins=http://localhost:3000 in the Olog service properties file. As noted, this will not work for browsers not on localhost.

Sadly changing the setting to cors.allowed.origins=* (or add java option -Dcors.allowed.origins=*) will not solve the problem. We would need to change (and test) a configuration change on the service to allow a wildcard pattern. Will address this shortly.

Also to be noted: the web client has switched build tools, see Customization and Environment Variables.

[georgweiss]

@mdavidsaver, any reason to keep this open?