Acess-Control-Allow-Headers CORS Error with API after updating discourse

[pablogg (Pablo)]

I upgrade discourse yesterday and I get all the API callbacks with error I have found that the problem is the autentications headers (1) but I trying with some calls and I get this error:

Access to XMLHttpRequest at 'https://mydomain.com/notifications.json?username=admin' from origin 'https://mydomain.com' has been blocked by CORS policy: Request header field api-username is not allowed by Access-Control-Allow-Headers in preflight response.

I using Vue and I have added the api-key and api-username to the heades like this:

Vue.http
        .get(
             "https://discourse.mydomain.com/notifications.json?username="+input.username,
          {
            headers: {
             "Api-Key":"xxxxxxxxxxxxxxxxx",
             "Api-Username": "system",
              "content-type": "application/json",
              accept: "application/json"
            }
          }
        )

(1) Discourse API Documentation

[blake (Blake Erickson)]

You may need to have CORS setup in your site settings?

[pablogg (Pablo)]

Yes, I have added the domain where I call the API in discourse settings, but that error about field api-username, I dont know when I have to resolve.

[RGJ (Richard - Communiteq)]

@pablogg

I using Vue

"Api-Key":"xxxxxxxxxxxxxxxxx", 
"Api-Username": "system",

You are putting your system API key in client side code?
This means that anyone can grab it from your Javascript code and use it to completely own your forum.

Any Ajax HTTP requests to Discourse should be leveraging an existing session, or not be needing a session at all.

[pablogg (Pablo)]

Not just a testing , I am using the username

      Vue.http
    .get(
      "https://discourse.mydomain.com/notifications.json?username="+input.username,
      {
        headers: {
       "Api-Key":"xxxxxxxxxxxxxxxxxxxxxx",
        "Api-Username": input.username    
        }
      }
    )

But I getting the same error with de Cors and the field api-username

[RGJ (Richard - Communiteq)]

Let me repeat what I said:

@RGJ

Any Ajax HTTP requests to Discourse should be leveraging an existing session

That means: no authentication headers. At all.

[blake (Blake Erickson)]

You really should not be using these API credentials for CORS requests which is why that header field is not allowed.

CORS error accessing API from javascript application

Oh, so you are trying to make this request from a client-side javascript application? That is not permitted for numerous reasons. For example, if you include an admin API key in the source code of your javascript app, any user could gain full admin access to your forum. Here is a previous topic on the subject.

However we do allow the user-api headers in CORS:

Request header field User-Api-Key is not allowed by Access-Control-Allow-Headers

I’m trying to post comments to my Discourse instance from another web application using user api keys. I managed to get the user key following the method described in your original topic and this other useful discussion. After getting the key, when I send it along with my requests as a value of the User-Api-Key header, I get the Request header field User-Api-Key is not allowed by Access-Control-Allow-Headers error. As I asked in my PR, I’m not sure if it’s enough to add the headers in the file…

[pablogg (Pablo)]

I have read the User API keys specification …

In my case I have SSO with a frontend app in javascript, Could I consuming the API without using the authorization UI for every user? I would like a way that a could use de api-username … is that possible?

Regards

[federico_lezcano]

could you solve this?
Thank you!

[pablogg (Pablo)]

In the end, I went back to the previous version of Discourse so I didn’t have to change all the API integration