[ https://issues.apache.org/jira/browse/COUCHDB-431?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13186932#comment-13186932 ]
Jason Smith commented on COUCHDB-431: ------------------------------------- I have a partial implementation of Benoit's updated spec at http://friendpaste.com/4q1zeNUEtPFS7XbioPYYzM https://github.com/jhs/couchdb/commits/newcors/ This includes two etap files, with 44 tests so far. There is no HTTP code yet. I plan to use Benoit's http code and tests from his patches on this ticket, which have been reviewed by several people. For now I am focusing on getting good tests about CORS policy. My code so-far is a new module, couch_cors_policy.erl. It has almost no connection or dependency with Couch. It does not require initialization. It is not necessary to start any couch_* servers. Its primary function is check/3 Given parameters (1) a global configuration, i.e. couch_config stuff, (2) a local configuration (a _security object), and an #httpd{} request, it will return a list of the correct CORS headers, or 'false' if the response should not support CORS. When couch_config is running, you can omit the first parameter, and it will derive it from the config. See test/etap/251-cors-config.t. In any case, test/etap/250-cors-policy.t exercises the policy decisions and whether they are correct. It is in-progress, but the tests cover a few aspects: * The interaction between _security and the _config (in general, _security takes precedence) * Correct headers according to the spec * Defaults, and their interaction with user settings Feedback is appreciated. Thanks. > Support cross domain XMLHttpRequest (XHR) calls by implementing Access > Control spec > ----------------------------------------------------------------------------------- > > Key: COUCHDB-431 > URL: https://issues.apache.org/jira/browse/COUCHDB-431 > Project: CouchDB > Issue Type: New Feature > Components: HTTP Interface > Affects Versions: 0.9 > Reporter: James Burke > Assignee: Benoit Chesneau > Priority: Minor > Fix For: 1.3 > > Attachments: 0001-cors-support.-should-fix-COUCHDB-431-2.patch, > 0001-cors-support.-should-fix-COUCHDB-431.patch, > 0001-cors-support.-should-fix-COUCHDB-431.patch, > 0001-cors-support.-should-fix-COUCHDB-431.patch, > 0001-cors-support.-should-fix-COUCHDB-431.patch, > A_0001-Generalize-computing-the-appropriate-headers-for-any.patch, > A_0002-Send-server-headers-for-externals-responses.patch, > A_0003-Usably-correct-w3c-CORS-headers-for-valid-requests.patch, > A_0004-Respond-to-CORS-preflight-checks-HTTP-OPTIONS.patch, cors.html, > cors_test.html, test_cors2-1.tgz, test_cors2.tgz > > > Historically, browsers have been restricted to making XMLHttpRequests (XHRs) > to the same origin (domain) as the web page making the request. However, the > latest browsers now support cross-domain requests by implementing the Access > Control spec from the W3C: > http://dev.w3.org/2006/waf/access-control/ > In order to keep older servers safe that assume browsers only do same-domain > requests, the Access Control spec requires the server to opt-in to allow > cross domain requests by the use of special HTTP headers and supporting some > "pre-flight" HTTP calls. > Why should CouchDB support this: in larger, high traffic site, it is common > to serve the static UI files from a separate, differently scaled server > complex than the data access/API server layer. Also, there are some API > services that are meant to be centrally hosted, but allow API consumers to > use the API from different domains. In these cases, the UI in the browser > would need to do cross domain requests to access CouchDB servers that act as > the API/data access server layer. > JSONP is not enough in these cases since it is limited to GET requests, so no > POSTing or PUTing of documents. > Some information from Firefox's perspective (functionality available as of > Firefox 3.5): > https://developer.mozilla.org/en/HTTP_access_control > And information on Safari/Webkit (functionality in latest WebKit and Safari > 4): > http://developer.apple.com/safari/library/documentation/AppleApplications/Conceptual/SafariJSProgTopics/Articles/XHR.html > IE 8 also uses the Access Control spec, but the requests have to go through > their XDomainRequest object (XDR): > http://msdn.microsoft.com/en-us/library/cc288060%28VS.85%29.aspx > and I thought IE8 only allowed GET or POST requests through their XDR. > But as far as CouchDB is concerned, implementing the Access Control headers > should be enough, and hopefully IE 9 will allow normal xdomain requests via > XHR. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira