chengshiwen opened a new pull request #4490: URL: https://github.com/apache/incubator-dolphinscheduler/pull/4490
## *Tips* - *Thanks very much for contributing to Apache DolphinScheduler.* - *Please review https://dolphinscheduler.apache.org/en-us/community/index.html before opening a pull request.* ## What is the purpose of the pull request **Fix cors problem** This closes issue #4439 and pr #4444 ## Brief change log Before this pr, DS use cookies to solve authentication and locale under same origin. But under cors (Cross-Origin Resource Sharing), this way cannot take effect, since based on cookies: - `Access-Control-Allow-Credentials: true`, `Access-Control-Allow-Methods: *`, and `Access-Control-Allow-Origin: <origin> | *` must be configured in **API response** - `withCredentials: true` must be configured in **frontend request** - If `Access-Control-Allow-Credentials: true` is configured, the request would fail if the value of the Access-Control-Allow-Origin header was "*", so that any origin under cors would fail. See [Credentialed requests and wildcards](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Credentialed_requests_and_wildcards) CORS detail refs: - Chinese: https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Access_control_CORS - English: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS Solution: - Use header to solve authentication and locale instead of cookies - Add `sessionId` and `language` header in frontend request - Add `language` change interceptor in backend - The header `sessionId` interceptor has supported in backend Change log - *Modify authentication by sessionId from cookie to header under non-cors and cors* - *Modify locale by language from cookie to header under cors* - *Fix warning in npm install* ## Verify this pull request This change added tests and can be verified as follows: *(example:)* - *Add `dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/interceptor/LocaleChangeInterceptorTest.java` - *Manually verified the change by testing locally.* **Gif check**:  **Video check**: [Video Link](https://recordit.co/UEct2v4miH) ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected]
