Improve CORS support
(Waiting for CI before removing the WIP label.)
@anoe I have implemented a bunch of fixes/improvements around the way we were handling CORS requests. Now, at least for multiple localhost instances, this is working as intended:
Read me
There is important change:
- I have added a new file called
gargantext-cors-settings.toml
which uses TOML a config language similar to.ini
(but with better support for things like lists etc) to define a list of allowed origins that our server will accept for CORS requests. Unfortunately we cannot use wildcards as that's rejected by the RFC6454, so we need to be explicit. If we ever decide to add more hosts, we need to remember to extend this file and restart the server.
Now, I think that as far as Nginx goes, we shouldn't need to amend it, because I think the problem we were getting in #302 (closed) was that the frontend started to pass the x-garg-error-scheme
, HTTP header, and that, per our CORS policy, wasn't exposed, and thus we were getting a rejection. In theory if you re-deploy the servers (for example demo
and/or dev.sub
) things should work now.
If they don't, we can look at the individual logs to further drill down to the problem.