search

buildingSMART / bSDD

The buildingSMART Data Dictionary repository, where we publish the documentation, examples and more. We don't publish here the data, the source code of the bSDD service or the front end of the website.
https://www.buildingsmart.org/users/services/buildingsmart-data-dictionary/
MIT License
135 stars 36 forks source link

CORS headers are not set, disabling usage from javascript in browsers #23

Closed Amoki closed 3 years ago

Amoki commented 3 years ago

Describe the bug CORS is security implemented by browsers limiting requests sent to another domain. The swagger works because it shares the same domain as the API.

Requesting the API from any other web page will result in a CORS exception.

To Reproduce Steps to reproduce the behavior:

  1. Open the console from any page other than the swagger
  2. Paste (or write) fetch('https://bs-dd-api-prototype.azurewebsites.net/api/Domain/v2') in the console
  3. See the cors error

Expected behavior Be able to request the API from browsers

Screenshots Capture d’écran de 2021-03-03 11-28-38

Amoki commented 3 years ago

If someone wants to build a JS plugin during the hackathon, you can use https://www.npmjs.com/package/local-cors-proxy as a temporary workaround

Baars-IT commented 3 years ago

I see the issue, I will have a look at it. Not sure if I'll manage during the hackathon.

Baars-IT commented 3 years ago

@Amoki The CORS issue has been fixed. Tested it with a simple html/javascript. Doing the "fetch" from the Chrome and Edge console gave other issues. The fix has been deployed to bs-dd-api-prototype.azurewebsites.net.

Amoki commented 3 years ago

Thanks, I confirm it's fixed!

MattiaCandal commented 1 year ago

Hi I am trying to test a js api call but I am not so familiar with this kind of topics. So sorry in advance if I am asking something trivial but I want to learn.

Baars said that the fix has been deployed to "bs-dd-api-prototype.azurewebsites.net"...what does it mean? How can I reach that?

Moreover, is the fix the slution Amoki proposed (local-cors-proxy) or Baars is referring to another kind of fix?

Thank you for your help

Erik-RN commented 1 year ago

Hi Mattia, Can you explain "I am trying to test a js api call"? Are you experiencing the CORS issue?

MattiaCandal commented 1 year ago

Hi Erik, Yes at the moment I am having the CORS issue. And I did not understand if the fix issue Baars was talking about refers to the Amoki proxy solution or another kind of fix which does not require proxy.

For "testing a js api call" I mean that I would like to run with JS a demo of the bsdd API, in a similar way to the one that are provided on github with python and c#. However since I am not an expert of authentication and api calls I don't know how to do it. I am using the python demo on github as a reference for the logical flow but I am not sure on the best way to "convert" it in a JS SPA.

Thank for your time!

Erik-RN commented 1 year ago

@MattiaCandal I've added a simple javascript example how to call the bSDD API. https://github.com/buildingSMART/bSDD/blob/master/Source%20code%20examples/javascript/simple-example-accessing-open-bsdd-api.html As many bSDD API's do not require authentication, I've left the authentication part out of this simple example. Hope this helps.

MattiaCandal commented 1 year ago

Hi Erik-RN,

Thank you for the JS example! It helped me a lot and now I can access the data I needed. Also now I have a more clear idea of how API works too.