3

Context and troubles

I'm currently building a web application on top of ezPlatform & Symfony.

My goal is now to request this app from an external website using a JS client (using the JS REST client of ezplatform : CAPI.js)

I tested my script localy (on the app itself = same domain) and everything is fine : I can GET and POST data.

But testing this script on an external webiste (CORS requests) didn't work. I am stuck with 2 differents problems :

  1. Server side : The response headers do not contains the Access-Control-Allowed-Methods
  2. Client side : No session cookies are given within a request

Details

Problem 1 : No header "allow_methods"

On chrome I always have this error : 

XMLHttpRequest cannot load http://api.ezplatform.lan/api/ezp/v2/user/sessions. Response for preflight has invalid HTTP status code 405

Note that, on the server side, nelmio_cors bundle is used to configures the headers. The configs :

nelmio_cors:
    paths:
        '^/api/ezp/v2/':
            max_age: 3600
            allow_credentials: true
            allow_origin: ['*']
            allow_methods: ['POST', 'PUT', 'GET', 'DELETE', 'OPTIONS']
            expose_headers: []

And now, here are the details of a failing preflight request :

GENERAL
Request URL:http://api.ezplatform.lan/api/ezp/v2/user/sessions
Request Method:OPTIONS
Status Code:405 Method Not Allowed
Remote Address:192.168.1.82:80

REPONSE HEADERS
Access-Control-Allow-Credentials:true
Access-Control-Allow-Headers:authorization, accept, content-type, x-csrf-token, destination, x-siteaccess
Access-Control-Allow-Origin:http://www.externalsite.lan
Access-Control-Max-Age:3600
Cache-Control:private
Connection:Keep-Alive
Content-Length:0
Content-Type:text/html; charset=UTF-8
Date:Tue, 13 Dec 2016 15:24:44 GMT
Keep-Alive:timeout=5, max=99
Server:Apache/2.4.23 (Ubuntu)
Vary:X-User-Hash

REQUEST HEADERS
Accept:*/*
Accept-Encoding:gzip, deflate, sdch
Accept-Language:fr-FR,fr;q=0.8,en-US;q=0.6,en;q=0.4
Access-Control-Request-Headers:content-type
Access-Control-Request-Method:POST
Cache-Control:no-cache
Connection:keep-alive
Host:api.ezplatform.lan
Origin:http://www.externalsite.lan
Pragma:no-cache
Referer:http://www.externalsite.lan/
User-Agent:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36

In the "response headers", there is no Access-Control-Allow-Methods despite of the nelmio_cors configs.

Digging inside the nelmio_cors code I realized that the "allow_methods" config is retrieved but is then overwritten by something else, and here it becomes obscur to me.

This old ezpublish bug maybe give me a clue about the situation : the ezPublishRestBundle does not seems to find any "allowed method", and somehow overwrite the nelmio_cors config.

In the Resprovider.php file, if I force the methods getAllowedMethods to return this : return ["POST", "PUT", "GET", "DELETE", "OPTIONS"]; then I have no more 405 error but a very different problem (explained right after this)

Problem 2 : no session cookies allowed

With my previous wonderful hack, I can now get a little bit further : my request are allowed but some of them are still failing.

I noticed that no session cookie is passed inside the requests (which is the normal behaviour testing on the same domain).

This times it seems to come from the CAPI.js file : the XmlHttpRequest object never has the property withCredentials to true.

If I add this code XHR.withCredentials = true; in CAPI.js before the request is send, then it seems to be fine.

Conclusion

I really wonder if the ez Platform rest client has been designed to be used for cross domain, but it would be very surprising if not.

So I must do something wrong, and if someone can explain me what, I would be extemely grateful :)

Chris
  • 61
  • 6

0 Answers0