search

instructure / canvas-lms

The open LMS by Instructure, Inc.
https://github.com/instructure/canvas-lms/wiki
GNU Affero General Public License v3.0
5.41k stars 2.42k forks source link

CORS headers not set on API urls, making custom web apps from a separate origin from the instance impossible #2292

Open AverseABFun opened 7 months ago

AverseABFun commented 7 months ago

Summary:

Access-Control-Allow-Origin is not set on API urls, leading to any web app not being able to access any API url.

Steps to reproduce:

  1. Make a basic Canvas web app, for instance trying to access /api/v1/users/self with the correct authorization but on a different host then the Canvas instance
  2. Run it.
  3. Go to the browser and check the console in the inspect menu, you will see an error message looking something like: image

Expected behavior:

The Access-Control-Allow-Origin header is set properly to *, allowing any host to access it.

Actual behavior:

The Access-Control-Allow-Origin header is not set at all, leading to no request that returns data being able to be made.

Additional notes:

This can be worked around with a CORS proxy, but that is not preferable. For some requests, this can also be worked around with a no-cors mode, but that would not work for any requests that return necessary data, as no-cors makes no data be returned.