CORS + JSONP

[porjo]

I'd like to talk to the PowerDNS API directly from browser javascript. AFAIK I have 2 options:

• CORS (Cross-origin resource sharing)
• JSONP

I've attempted to use CORS, however PDNS does not handle the preflight OPTIONS request properly. I've also attempted to use JSONP however there is no way to include the X-API-Key with a JSONP request.

It'd be nice if Pdns could support CORS. Failing that, provide the option of disabling authentication completely in order for JSONP to work.

[cmouse]

@porjo can you test if this works for you?

[porjo]

I've tested GET, POST, PATCH and DELETE. I did have to make the following minor change however:

diff --git a/pdns/webserver.cc b/pdns/webserver.cc
index 322cdc6..b15d085 100644
--- a/pdns/webserver.cc
+++ b/pdns/webserver.cc
@@ -102,8 +102,8 @@ static void apiWrapper(WebServer::HandlerFunction handler, HttpRequest* req, Htt
   if (req->method == "OPTIONS") {
     if (req->headers.find("origin") != req->headers.end()) {
       resp->headers["access-control-allow-origin"] = req->headers["origin"];
-      resp->headers["access-control-allow-headers"] = "X-API-Key";
-      resp->headers["access-control-allow-methods"] = "GET POST PUT PATCH DELETE OPTIONS";
+      resp->headers["access-control-allow-headers"] = "X-API-Key, Content-Type";
+      resp->headers["access-control-allow-methods"] = "GET, POST, PUT, PATCH, DELETE, OPTIONS";
       resp->headers["access-control-max-age"] = "3600"; // maybe increase this
       resp->status = 200;
       resp->headers["content-type"]= "text/plain";
@@ -171,8 +171,8 @@ static void webWrapper(WebServer::HandlerFunction handler, HttpRequest* req, Htt
   if (req->method == "OPTIONS") {
     if (req->headers.find("origin") != req->headers.end()) {
       resp->headers["access-control-allow-origin"] = req->headers["origin"];
-      resp->headers["access-control-allow-headers"] = "X-API-Key";
-      resp->headers["access-control-allow-methods"] = "GET POST PUT PATCH DELETE OPTIONS";
+      resp->headers["access-control-allow-headers"] = "X-API-Key, Content-Type";
+      resp->headers["access-control-allow-methods"] = "GET, POST, PUT, PATCH, DELETE, OPTIONS";
       resp->headers["access-control-max-age"] = "3600"; // maybe increase this
       resp->status = 200;
       resp->headers["content-type"]= "text/plain";

[cmouse]

Ok. I'll do the change. Thank you for testing.

[zeha]

I'd personally not merge this without any unittests. I may take a closer look later, but am in belgium right now (:

[cmouse]

@zeha ok... i'll see if I can add unit test as well. The unit test framework for this is unfamiliar for me though.

[cmouse]

@zeha i think i was able to make unit test for it.