search

CiscoDevNet / api-design-guide

Guidelines for designing REST APIs at Cisco
https://apistyleguide.cisco.com/
109 stars 28 forks source link

CSR1000v REST API Fails To Meet Section 3 Guidelines, Namely 3.5.1.9 #1

Open ronnievsmith opened 7 years ago

ronnievsmith commented 7 years ago

Attempts at XHR/AJAX to the REST API fail due to CORS Reason: CORS header ‘Access-Control-Allow-Origin’ missing.

3.5.1.9 A service MUST support CORS simple and preflight request flows. Services SHOULD return "**" as the Access-Control-Allow-Origin header, unless the request is accompanied by an Origin header, in which case the service SHOULD return an Access-Control-Allow-Origin header with a value equal to that of the received Origin header. Services MUST NOT return an access-control-allow-credentials header in any HTTP response.

asgs commented 7 years ago

were those requests preflighted? Some servers don't respond with the CORS headers unless they think it's required to.

ronnievsmith commented 7 years ago

Web server must respond with "Access-Control-Allow-Origin: *" or the XHR will fail every time. "Preflight" really has nothing to do with this. Am I wrong? I got XHR working with my CSR (on virtual box on my laptop) but only after installing a CORS Everywhere/CORS anywhere browser hack.

On Fri, Mar 24, 2017 at 12:05 PM, asgs notifications@github.com wrote:

were those requests preflighted https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Preflighted_requests? Some servers don't respond with the CORS headers.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/CiscoDevNet/api-design-guide/issues/1#issuecomment-289082736, or mute the thread https://github.com/notifications/unsubscribe-auth/AMKS--O4vvS5GKOO1W2keVVU9r_fWao-ks5ro_fKgaJpZM4LFCuy .

--

asgs commented 7 years ago

you should post the complete XHR dump to see what's going on.

ronnievsmith commented 7 years ago

I know what's going on because I've spent the time and effort to utilize the REST interface. Your NGINX server is locked down (the NGINX credentials in CSR1000v are not published/available). It simply needs to have that 1 parameter either set, or configurable to be set on the web SERVER (in IOS Web management case, NGINX).

https://github.com/rhroyston/intrest/blob/master/script.js

See line 758 "function getToken(deviceId)" also line 882 "function httpReq( method, host, path, token)" on my intREST project on github. It's just vanilla XHR with minimal options/headers set.

BTW, I'm a freelance CCIE#6824 and looking for work (not employment). Why don't you hire me to flesh out some implementation guidelines or maybe an official Cisco intREST browser framework?

https://rack.pub

On Fri, Mar 24, 2017 at 12:59 PM, A.S. Gowri Sankar < notifications@github.com> wrote:

you should post the complete XHR dump to see what's going on.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/CiscoDevNet/api-design-guide/issues/1#issuecomment-289099529, or mute the thread https://github.com/notifications/unsubscribe-auth/AMKS-4tOma1usoL9bogeXzpzM6yORI1_ks5rpARxgaJpZM4LFCuy .

--

asgs commented 7 years ago

well, you got it all figured out. The ways the XHRs are constructed look right. So it's a setting that any fronting webserver exposes, that need to be set.

By the way, I'm no way related to Cisco nor this particular GitHub project. I just randomly happen to visit this project because I was looking for information on SCIM implementation (from Cisco) and notice that one issue that was open (or ever opened) here. Thought I'd do something about it.

Best wishes for your future work!

ronnievsmith commented 7 years ago

Got it. Yes, it's a setting on the Web server to allow CORS that's missing / the issue. Curl works fine (becuase it does not have the CORS security restrictions of browsers). I got it working and it's pretty slick. I'm on other paying projects at the moment and had to put intREST on the back burner for now.

BTW: I'll never be an employee again - I did that for 20 years. I work for me now. :-)

On Fri, Mar 24, 2017 at 1:51 PM, A.S. Gowri Sankar <notifications@github.com

wrote:

well, you got it all figured out. The ways the XHRs are constructed look right. So it's a setting that any fronting webserver would have to be set.

By the way, I'm no way related to Cisco nor this particular GitHub project. I just randomly happen to visit this project because I was looking for information on SCIM implementation (from Cisco) and notice that one issue that was open (or ever opened) here. Thought I'd do something about it.

Best wishes for your future employment!

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/CiscoDevNet/api-design-guide/issues/1#issuecomment-289113041, or mute the thread https://github.com/notifications/unsubscribe-auth/AMKS-x5Z1PzjZ4t93ESj-AEUJFUDEYbKks5rpBCdgaJpZM4LFCuy .

--