search

bcgov / DBC-APIM

DataBC OPEN API Services
Apache License 2.0
1 stars 0 forks source link

API Console - access control #97

Open BK01 opened 6 years ago

BK01 commented 6 years ago

The API console is experiencing an issue in PROD when submitting requests with an API key, leading to a Type:Error Failed to fetch message.

The issue looks to be due to use usage of '*' with access-control-allow-origin (see below). We may need to use explicit instead.

Test cases:

Geocoder using geocoder.api endpoint (addresses request) with an api key Route Planner :

Details: curl -I -XGET https://geocoder.api.gov.bc.ca/addresses.geojson HTTP/2 200 content-type: application/vnd.geo+json;charset=UTF-8 x-ratelimit-limit-minute: 1000 x-ratelimit-remaining-minute: 999 server: Apache-Coyote/1.1 x-xss-protection: 1; mode=block cache-control: no-cache, no-store, max-age=0, must-revalidate pragma: no-cache expires: 0 x-frame-options: DENY content-security-policy: script-src 'self' https://code.jquery.com https://unipear.api.gov.bc.ca 'unsafe-inline' 'unsafe-eval' date: Tue, 13 Mar 2018 22:34:46 GMT access-control-allow-origin: * access-control-expose-headers: Origin,Authorization,Access-Control-Allow-Origin,Access-Control-Allow-Methods,apikey

BK01 commented 6 years ago

@ll911 @banders We can discuss in greater detail anytime tomorrow before or during our API Mgmt meeting.

BK01 commented 6 years ago

re-test to confirm resolved. Weds 3pm test successful

BK01 commented 6 years ago

New API console TEST migration scheduled

BK01 commented 6 years ago

Testing in cat.data complete. Fix verified. Will schedule PROD for next week.