Bug 1380626 - [RFE] consider alternatives to ebay-cors-filter
Summary: [RFE] consider alternatives to ebay-cors-filter
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: ovirt-engine
Classification: oVirt
Component: RFEs
Version: 4.1.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified vote
Target Milestone: ---
: ---
Assignee: Scott Herold
QA Contact: Gil Klein
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-09-30 07:56 UTC by Sandro Bonazzola
Modified: 2016-10-17 15:29 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Enhancement
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-10-17 15:14:03 UTC
oVirt Team: Infra
rule-engine: planning_ack?
juan.hernandez: devel_ack-
rule-engine: testing_ack?


Attachments (Terms of Use)

Description Sandro Bonazzola 2016-09-30 07:56:11 UTC
Description of problem:
ebay-cors-filter has not received updates in the last 3 years, being the latest commit d86da0e  on 31 Jul 2013

Upstream maintainer is not working anymore for eBay and the project is currently dead.

Please consider moving to a maintained library

Comment 1 Martin Perina 2016-09-30 13:07:06 UTC
Juan, do you know of any other existing project/library which we could use instead?

Comment 2 Juan Hernández 2016-10-03 08:21:19 UTC
There are alternatives. Take into account that this was introduced in order to allow use of the API from JavaScript applications downloaded from other servers, mostly third party UI plugins, and that it is completely disabled by default. As this doesn't seem to be the future of the oVirt architecture I'd rather consider leaving it as it is, or removing it completely.

Comment 3 Martin Perina 2016-10-03 12:10:46 UTC
Vojtech, do we still need ebay-cors-filter? If so, then we should find some live alternative ...

Comment 4 Vojtech Szocs 2016-10-17 14:41:20 UTC
As Juan mentioned, CORS [1] is necessary when a web application hosted on non-Engine origin (protocol/domain/port) wishes to talk with Engine REST API. This is a consequence of Same-Origin Policy [2] enforced by all web browsers.

[1] https://en.wikipedia.org/wiki/Cross-origin_resource_sharing
[2] https://en.wikipedia.org/wiki/Same-origin_policy

CORS support for REST API therefore targets _only_ web applications that are hosted outside Engine origin.

One use case is a UI plugin whose HTML/JS files are not served via Engine [3]. However, this won't work in practice, because such plugin won't be able to access `parent.api` object due to Same-Origin Policy (code within iframe cannot access `parent` document). So this use case is not relevant.

[3] org.ovirt.engine.ui.frontend.server.gwt.plugin.PluginResourceServlet

This is also mentioned in UI plugin docs:

"
Note that "parent.pluginApi" is subject to Same-Origin Policy, this implies WebAdmin HTML page and plugin host page must be on same origin, which holds true when using UI plugin infrastructure to serve plugin resource files.
"

Another use case is a custom web application (different origin) that wishes to talk with REST API. In this case, users may decide to explicitly turn on CORS by setting following Engine config options:

  CORSSupport = true

  -and-

  CORSAllowedOrigins = * // dangerous, allow any origin

  -or-

  CORSAllowedOrigins = http://one:1234,http://two:8080

Since Engine REST API uses "RESTEasy" Java framework, I suggest to simply replace the outdated eBay CORS filter with:

  org.jboss.resteasy.plugins.interceptors.CorsFilter

so basically solving CORS on "RESTEasy" Java framework level, not on servlet/filter level.

This also means dropping org.ebaysf.web:cors-filter:1.0.1 Maven dependency, along with its JBoss module definition.

Comment 5 Juan Hernández 2016-10-17 15:13:52 UTC
Thanks for the suggestion Vojtech.

The Resteasy CORS support doesn't seem to be very active either: no updates in the last two years. In addition it brings a Resteasy specific dependency, which we have been trying to avoid. As having or not having CORS seems to be of little relevance we aren't doing any effort to change it.

Comment 6 Red Hat Bugzilla Rules Engine 2016-10-17 15:14:03 UTC
Development has indicated this request is declined. You may appeal this decision by reopening this request.

Comment 7 Vojtech Szocs 2016-10-17 15:25:03 UTC
I agree that depending even more on RESTEasy framework isn't too good.

So we can either keep using the eBay CORS filter as today, or roll our own impl. or simply remove CORS support (but this should be clearly communicated and discussed on devel list first).

Comment 8 Juan Hernández 2016-10-17 15:29:53 UTC
Just to be clear, my decision is to not change anything: CORS support will continue working, using the existing filter, it won't be removed.


Note You need to log in before you can comment on or make changes to this bug.