Che Theia - CORS issue when Theia IDE client side browser trying to reach Che master

[sunix]

Description

It happens that in some cluster configuration, Che Theia IDE is not located in the same location and when we are trying to reach Che master API from the browser, we encounter CORS issue like

Failed to load https://che.openshift.io/api/factory/factorywj3405v4cnxdjmln: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://routecw4tc0mt-sutan-1-che.8a09.starter-us-east-2.openshiftapps.com' is therefore not allowed access. The response had HTTP status code 403.

[sunix]

I see 2 ways of fixing it:

• somehow allow as origin all the possible cluster public url that a che master could have. That would be done dynamically according to Che configuration
• create a dedicated proxy in Theia node side for all our Che API.

[l0rd]

@sunix why is this happening for theia and was not with GWT based IDE? I mean none of the solutions you are proposing is ideal, why can't we do it the GWT way?

[sunix]

@l0rd GWT app was hosted by che master

[skabashnyuk]

@sunix would it help if we enable CORS https://github.com/eclipse/che/blob/master/core/che-core-api-core/src/main/java/org/eclipse/che/api/core/cors/CheCorsFilter.java for factories?

[sunix]

@skabashnyuk yes and no
Factory is not the only component trying to reach CHE_API_EXTERNAL:

• https://github.com/eclipse/che-theia-machines-plugin/blob/master/theia-machines-extension/src/browser/che-workspace-client-service.ts#L22
• https://github.com/eclipse/che-theia-task-plugin/blob/master/che-theia-task-extension/src/browser/che-api-external-endpoint-provider.ts#L26
• https://github.com/eclipse/che-theia-terminal-extension/blob/master/che-theia-terminal/src/browser/workspace/workspace.ts#L82

IMHO, we have to find a common way to fix all of them. BTW, most of these calls are to retrieve machine definition.

[AndrienkoAleksandr]

@sunix Maybe we should create common component and reuse it #11072

[benoitf]

I would say that if extensions were plug-ins, then they would call APIs from server-side and then it won't hit CORS.

So if extension is still mandatory, they should use a server-side service.
I'm not sure it is interesting to have a proxy service as extensions should not be used

[sunix]

@benoitf thanks so maybe we could start moving factory extension to a plugin. It has to be done sooner or later anyway.

[ashumilova]

@sunix do we know which APIs are missing to convert factory extension to plugin?

[sunix]

@ashumilova

1. retrieve the url query string to get the factory id
2. execute a given task
3. open a file
4. some UI entry point for notifications
5. git (clone, checkout)
6. trigger when app is ready

[evidolob]

The problem should be fixed by #11306

[sunix]

It is fixed as far as I know