Find a way to enable CORS headers #57

Activity

1. michielbdejong commented on Nov 24, 2021

   

   michielbdejong

   on Nov 24, 2021

   Last edited by michielbdejong

   MemberAuthor

   More actions

   https://github.com/pdsinterop/solid-nextcloud#manual-install instructs the user to enable CORS headers on the entire server, which is overkill and DANGEROUS because it could allow cross-site scripting to other Nextcloud apps if the user is logged in with a cookie.
2. michielbdejong commented on Nov 24, 2021

   

   michielbdejong

   on Nov 24, 2021

   Last edited by michielbdejong

   MemberAuthor

   More actions

   should work with a directory tag, too:
   a2enmod headers and then:

   <Directory /var/www/html>
      ...
      Header always set Access-Control-Allow-Origin *
      ...
   </Directory>
   
3. michielbdejong commented on Nov 24, 2021

   

   michielbdejong

   on Nov 24, 2021

   MemberAuthor

   More actions

   Putting it in the Directory works for /var/www/html but not if you put it in /var/www/apps/solid because according to apache all requests are handled by /var/www/html/index.php.
4. michielbdejong commented on Nov 24, 2021

   

   michielbdejong

   on Nov 24, 2021

   MemberAuthor

   More actions

   Maybe we should uncomment https://github.com/pdsinterop/php-solid-crud/blob/b6816c0/src/Server.php#L117-L123
   So then at least all the routes on the storage would get CORS headers and then we would only need to deal with /.well-known/openid-provider separately.
5. michielbdejong

   added a commit that references this issue on Nov 24, 2021

   Add CORS headers at the php-solid-crud level

   ...

   15fe5d6
6. michielbdejong commented on Nov 24, 2021

   

   michielbdejong

   on Nov 24, 2021

   Last edited by michielbdejong

   MemberAuthor

   More actions

   Ah, using that ^ and in addition, if you create a static file:

   mkdir -p /var/www/html/.well-known
   curl https://cloud.pondersource.org/index.php/apps/solid/openid > /var/www/html/.well-known/openid-configuration

   Add this to your /etc/apache2/sites-enabled/000-default.conf:

   <Directory /var/www/html/.well-known/>
       Header always set Access-Control-Allow-Origin: *
   </Directory>
   

   and then:

   a2dismod rewrite
   systemctl restart apache

   Then it works! :)
7. michielbdejong commented on Nov 24, 2021

   

   michielbdejong

   on Nov 24, 2021

   MemberAuthor

   More actions

   Testing this out now... next error:

   Access to fetch at 'https://cloud.pondersource.org/index.php/apps/solid/jwks' from origin 'https://noeldemartin.github.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
   

   So that needs the same edit in https://github.com/pdsinterop/php-solid-auth/blob/b08a3910d49535afd3d77db264badcd564f31f6e/src/Server.php#L148
8. Potherca

   added this to Solid Serverson Nov 26, 2021
9. michielbdejong commented on Sep 27, 2022

   

   michielbdejong

   on Sep 27, 2022

   MemberAuthor

   More actions

   Fixed in #93
10. Potherca commented on Sep 27, 2022

    

    Potherca

    on Sep 27, 2022

    Member

    More actions

    @michielbdejong Can we close this issue?
11. michielbdejong commented on Sep 27, 2022

    

    michielbdejong

    on Sep 27, 2022

    MemberAuthor

    More actions

    @Potherca it will be closed automatically when #93 is merged
12. michielbdejong

    linked a pull request that will close this issueSend CORS headers on /.well-known/openid-configuration response #93on Sep 27, 2022
13. michielbdejong commented on Sep 27, 2022

    

    michielbdejong

    on Sep 27, 2022

    MemberAuthor

    More actions

    Ah, actually that wasn't true when I wrote it but it is true now :)
14. ylebre

    closed this as completedin #93on Sep 27, 2022
15. ylebre

    moved this to Done in Solid Serverson Sep 27, 2022
16. Potherca

    added this to the v0.6.0 milestone on Oct 19, 2022