Acess-Control-Allow-Headers CORS-Fehler mit API nach Aktualisierung von Discourse

[pablogg (Pablo)]

Ich habe Discourse gestern aktualisiert und erhalte bei allen API-Rückrufen einen Fehler. Ich habe herausgefunden, dass das Problem in den Authentifizierungs-Headern liegt (1). Bei einigen Testaufrufen erhalte ich jedoch diesen Fehler:

Zugriff auf XMLHttpRequest an 'https://mydomain.com/notifications.json?username=admin' von der Herkunft 'https://mydomain.com' wurde durch die CORS-Richtlinie blockiert: Das Anforderungs-Header-Feld api-username ist in der Preflight-Antwort von Access-Control-Allow-Headers nicht erlaubt.

Ich verwende Vue und habe den api-key und api-username wie folgt zu den Headern hinzugefügt:

Vue.http
        .get(
             "https://discourse.mydomain.com/notifications.json?username="+input.username,
          {
            headers: {
             "Api-Key":"xxxxxxxxxxxxxxxxx",
             "Api-Username": "system",
              "content-type": "application/json",
              accept: "application/json"
            }
          }
        )

(1) Discourse REST API Documentation

[blake (Blake Erickson)]

You may need to have CORS setup in your site settings?

[pablogg (Pablo)]

Yes, I have added the domain where I call the API in discourse settings, but that error about field api-username, I dont know when I have to resolve.

[RGJ (Richard - Communiteq)]

@pablogg

I using Vue

"Api-Key":"xxxxxxxxxxxxxxxxx", 
"Api-Username": "system",

You are putting your system API key in client side code?
This means that anyone can grab it from your Javascript code and use it to completely own your forum.

Any Ajax HTTP requests to Discourse should be leveraging an existing session, or not be needing a session at all.

[pablogg (Pablo)]

Not just a testing , I am using the username

      Vue.http
    .get(
      "https://discourse.mydomain.com/notifications.json?username="+input.username,
      {
        headers: {
       "Api-Key":"xxxxxxxxxxxxxxxxxxxxxx",
        "Api-Username": input.username    
        }
      }
    )

But I getting the same error with de Cors and the field api-username

[RGJ (Richard - Communiteq)]

Let me repeat what I said:

@RGJ

Any Ajax HTTP requests to Discourse should be leveraging an existing session

That means: no authentication headers. At all.

[blake (Blake Erickson)]

You really should not be using these API credentials for CORS requests which is why that header field is not allowed.

CORS error accessing API from javascript application

Oh, so you are trying to make this request from a client-side javascript application? That is not permitted for numerous reasons. For example, if you include an admin API key in the source code of your javascript app, any user could gain full admin access to your forum. Here is a previous topic on the subject.

However we do allow the user-api headers in CORS:

Request header field User-Api-Key is not allowed by Access-Control-Allow-Headers

I’m trying to post comments to my Discourse instance from another web application using user api keys. I managed to get the user key following the method described in your original topic and this other useful discussion. After getting the key, when I send it along with my requests as a value of the User-Api-Key header, I get the Request header field User-Api-Key is not allowed by Access-Control-Allow-Headers error. As I asked in my PR, I’m not sure if it’s enough to add the headers in the file…

[pablogg (Pablo)]

I have read the User API keys specification …

In my case I have SSO with a frontend app in javascript, Could I consuming the API without using the authorization UI for every user? I would like a way that a could use de api-username … is that possible?

Regards

[federico_lezcano]

Könntest du das lösen?
Vielen Dank!

[pablogg (Pablo)]

Am Ende bin ich zur vorherigen Version von Discourse zurückgekehrt, damit ich nicht alle API-Integrationen anpassen musste.