support cors preflight and better cors support

tracim/__init__.py

@@ -3,13 +3,11 @@ import json
 import time
 
 from pyramid.config import Configurator
-from pyramid.events import NewResponse
 from pyramid.authentication import BasicAuthAuthenticationPolicy
 from hapic.ext.pyramid import PyramidContext
 
 from tracim.extensions import hapic
 from tracim.config import CFG
-from tracim.lib.utils.pyramid_events import cors_headers
 from tracim.lib.utils.request import TracimRequest
 from tracim.lib.utils.authentification import basic_auth_check_credentials
 from tracim.lib.utils.authentification import BASIC_AUTH_WEBUI_REALM
@@ -18,6 +16,7 @@ from tracim.lib.utils.authorization import TRACIM_DEFAULT_PERM
 from tracim.views import BASE_API_V2
 from tracim.views.core_api.session_controller import SessionController
 from tracim.views.errors import ErrorSchema
+from tracim.lib.utils.cors import add_cors_support
 
 
 def main(global_config, **settings):
@@ -33,6 +32,9 @@ def main(global_config, **settings):
         basic_auth_check_credentials,
         realm=BASIC_AUTH_WEBUI_REALM,
     )
+    configurator.include(add_cors_support)
+    # make sure to add this before other routes to intercept OPTIONS
+    configurator.add_cors_preflight_handler()
     # Default authorization : Accept anything.
     configurator.set_authorization_policy(AcceptAllAuthorizationPolicy())
     configurator.set_authentication_policy(authn_policy)
@@ -46,7 +48,6 @@ def main(global_config, **settings):
     configurator.include('pyramid_jinja2')
     # Add SqlAlchemy DB
     configurator.include('.models')
-    configurator.add_subscriber(cors_headers, NewResponse)
     # set Hapic
     hapic.set_context(
         PyramidContext(

tracim/lib/utils/cors.py

@@ -0,0 +1,77 @@
+# -*- coding: utf-8 -*-
+# INFO - G.M -17-05-2018 - CORS support
+# original code from https://gist.github.com/mmerickel/1afaf64154b335b596e4
+# see also
+# here : https://groups.google.com/forum/#!topic/pylons-discuss/2Sw4OkOnZcE
+from pyramid.events import NewResponse
+
+
+def add_cors_support(config):
+    # INFO - G.M - 17-05-2018 - CORS Preflight stuff (special requests)
+    config.add_directive(
+        'add_cors_preflight_handler',
+        add_cors_preflight_handler
+    )
+    config.add_route_predicate('cors_preflight', CorsPreflightPredicate)
+
+    # INFO - G.M - 17-05-2018 CORS Headers for all responses
+    config.add_subscriber(add_cors_to_response, NewResponse)
+
+
+class CorsPreflightPredicate(object):
+    def __init__(self, val, config):
+        self.val = val
+
+    def text(self):
+        return 'cors_preflight = %s' % bool(self.val)
+
+    phash = text
+
+    def __call__(self, context, request):
+        if not self.val:
+            return False
+        return (
+            request.method == 'OPTIONS' and
+            'Origin' in request.headers and
+            'Access-Control-Request-Method' in request.headers
+        )
+
+
+def add_cors_preflight_handler(config):
+    # INFO - G.M - 17-05-2018 - Add route for CORS preflight
+    # see https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request
+    # for more info about preflight
+
+    config.add_route(
+        'cors-options-preflight', '/{catch_all:.*}',
+        cors_preflight=True,
+    )
+    config.add_view(
+        cors_options_view,
+        route_name='cors-options-preflight',
+    )
+
+
+def cors_options_view(context, request):
+    response = request.response
+    if 'Access-Control-Request-Headers' in request.headers:
+        response.headers['Access-Control-Allow-Methods'] = (
+            'OPTIONS,HEAD,GET,POST,PUT,DELETE'
+        )
+    response.headers['Access-Control-Allow-Headers'] = (
+        'Content-Type,Accept,Accept-Language,Authorization,X-Request-ID'
+    )
+    return response
+
+
+def add_cors_to_response(event):
+    # INFO - G.M - 17-05-2018 - Add some CORS headers to all requests
+    request = event.request
+    response = event.response
+    if 'Origin' in request.headers:
+        response.headers['Access-Control-Expose-Headers'] = (
+            'Content-Type,Date,Content-Length,Authorization,X-Request-ID'
+        )
+        # TODO - G.M - 17-05-2018 - Allow to configure this header in config
+        response.headers['Access-Control-Allow-Origin'] = '*'
+        response.headers['Access-Control-Allow-Credentials'] = 'true'

tracim/lib/utils/pyramid_events.py

@@ -1,5 +0,0 @@
-
-
-def cors_headers(context):
-    # TODO - G.M - 17-05-2018 - Allow to configure this header in config
-    context.response.headers['Access-Control-Allow-Origin'] = '*'