CORS I'm struggling about ara-web HOT 4 OPEN

Hi @flare04 o/

CORS issues are not fun. Maybe you can find something in another CORS issue that would ring a bell: #18

or maybe I can help and we try to figure it out :)

We have a live demo deployment of ara-web here: https://web.demo.recordsansible.org/
and it is set up to talk to this API server: https://api.demo.recordsansible.org/

So there is some CORS action going on and it works.

The relevant parts of the configuration are available in the playbook used to deploy them:
https://github.com/ansible-community/ara-infra/blob/45c8a7a5ba8f2d8ca1f8444a5e4c6266ac9d3512/playbooks/live-demo.yaml#L11-L18 (roles are here)

I think the ara_api_cors_origin_allow_all: true was meant to be temporary while we figured out what were the right rules to use and it stayed like that ¯\(ツ)/¯

Truth be told, I haven't had much time to spend on ara-web but I'd be happy to try to point you in the right direction and we can improve the docs if necessary.

from ara-web.

Hi,

Thanks for your quick response
export ARA_CORS_ORIGIN_ALLOW_ALL=true
"fixed" it for me, note it is already set in the settings.yaml file
I swear it's not reading this file, even though it reports it is

from ara-web.

@flare04 I got a feeling you might be hitting a settings regression: ansible-community/ara#149

Could you try pinning dynaconf to <3.0.0 and see if that fixes it ? The bug is on my todo list.

from ara-web.

I might be years late, but I'd like to provide my two cents so this issue can be closed:

You say the browser tells you

Access to XMLHttpRequest at 'http://ara.domain.com.au:8000/api/v1/' from origin 'http://ara.domain.com.au:3000/' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Which means you are browsing from http://ara.domain.com.au:3000/.

The config pasted mentions 'https://ara.domain.com.au', 'https://server.domain.com.au'. Both of which are not what you are using, so it's only normal that it doesn't work. I don't know about ara reading settings, but those origins are not the ones you are using so it's never going to work. You need to provide the actual origin, that is, the actual url (without path) of the page you are browsing. Failing that, your config will never work. If you tried with another config, I didn't see it.

from ara-web.