Unable to configure CORS origins in multi-user Che

[vinokurig]

Describe the bug

Api requests to Che multi-user server from Che client side fail due to CORS error:

Access to XMLHttpRequest at 'http://che-che.192.168.99.194.nip.io/api/user&token=***' from origin 'http://serveru8v0e6p6-che-dev-server-3010.192.168.99.194.nip.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

There is no CHE_CORS_ALLOWED__ORIGINS item in the che config-map

Che version

• latest
• nightly
• other: please specify

Steps to reproduce

build and launch a simple che-theia plugin that does:
che.github.uploadPublicSshKey('publicKey');

See CORS errors in the browser console

Expected behavior

Runtime

• kubernetes (include output of kubectl version)
• Openshift (include output of oc version)
• minikube (include output of minikube version and kubectl version)
• minishift (include output of minishift version and oc version)
• docker-desktop + K8S (include output of docker version and kubectl version)
• other: (please specify)

Screenshots

Installation method

• chectl
• che-operator
• minishift-addon
• I don't know

Environment

• my computer
  • Windows
  • Linux
  • macOS
• Cloud
  • Amazon
  • Azure
  • GCE
  • other (please specify)
• other: please specify

Additional context

[benoitf]

you can't upload from nodejs ? (instead of doing it from client side)

[vinokurig]

No, the request is called in the client side. the code described in the steps to reproduse is just an example the calls the request to che server from client side

[benoitf]

@vinokurig yes but client can't call server side to do the operation ?

[vinokurig]

@benoitf Why not? It is possible in the single user Che.

[skabashnyuk]

CC @l0rd

@vinokurig cors is disabled intentionally #14921 since it is a source of a lot of security concerns. Could you please reimplement this functionality from the server-side.

[skabashnyuk]

@vinokurig we need to carefully discuss this topic with architects before we go any forward with CORS

[vinokurig]

Closing as expected behaviour

[IveJ]

Hi All, https://che.eclipse.org/eclipse-che-6-15-6-16-and-6-17-release-notes-362cff44dcc9 https://developer.chrome.com/extensions/xhr Wish to helpful.

…

On Thu, Jan 9, 2020, 19:05 Igor Vinokur ***@***.***> wrote: Closed #15631 <#15631>. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#15631>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AEYAML24RBF6LMR7RVNPOBDQ44HG7ANCNFSM4KEJ47UQ> .