diff --git a/changelog/unreleased/more-cors-config.md b/changelog/unreleased/more-cors-config.md new file mode 100644 index 000000000..67d571e1e --- /dev/null +++ b/changelog/unreleased/more-cors-config.md @@ -0,0 +1,5 @@ +Bugfix: Add missing CORS config + +The graph, userlog and ocdav services had no CORS config options. + +https://github.com/owncloud/ocis/pull/5987 diff --git a/go.mod b/go.mod index 1f536fcab..2d215f664 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/blevesearch/bleve/v2 v2.3.7 github.com/coreos/go-oidc/v3 v3.4.0 github.com/cs3org/go-cs3apis v0.0.0-20221012090518-ef2996678965 - github.com/cs3org/reva/v2 v2.12.1-0.20230331184913-eca8953fb6e9 + github.com/cs3org/reva/v2 v2.12.1-0.20230403080425-f93a726ab656 github.com/disintegration/imaging v1.6.2 github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e github.com/egirna/icap-client v0.1.1 diff --git a/go.sum b/go.sum index 11485ca34..03ac3a0d2 100644 --- a/go.sum +++ b/go.sum @@ -627,6 +627,8 @@ github.com/crewjam/saml v0.4.13 h1:TYHggH/hwP7eArqiXSJUvtOPNzQDyQ7vwmwEqlFWhMc= github.com/crewjam/saml v0.4.13/go.mod h1:igEejV+fihTIlHXYP8zOec3V5A8y3lws5bQBFsTm4gA= github.com/cs3org/reva/v2 v2.12.1-0.20230331184913-eca8953fb6e9 h1:zUMD0UvKVPbR3UaodnA0GXuBycxrIuaO8Kshgi3iKKI= github.com/cs3org/reva/v2 v2.12.1-0.20230331184913-eca8953fb6e9/go.mod h1:FNAYs5H3xs8v0OFmNgZtiMAzIMXd/6TJmO0uZuNn8pQ= +github.com/cs3org/reva/v2 v2.12.1-0.20230403080425-f93a726ab656 h1:FAlxhUtG0/57X4i05x3suRd/rtAecM/7ZWeJ9ZtqrIc= +github.com/cs3org/reva/v2 v2.12.1-0.20230403080425-f93a726ab656/go.mod h1:FNAYs5H3xs8v0OFmNgZtiMAzIMXd/6TJmO0uZuNn8pQ= github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8 h1:Z9lwXumT5ACSmJ7WGnFl+OMLLjpz5uR2fyz7dC255FI= github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8/go.mod h1:4abs/jPXcmJzYoYGF91JF9Uq9s/KL5n1jvFDix8KcqY= github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4= diff --git a/services/graph/pkg/config/config.go b/services/graph/pkg/config/config.go index 15b1d966c..ea920a20f 100644 --- a/services/graph/pkg/config/config.go +++ b/services/graph/pkg/config/config.go @@ -112,3 +112,11 @@ type Events struct { TLSRootCACertificate string `yaml:"tls_root_ca_certificate" env:"GRAPH_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided GRAPH_EVENTS_TLS_INSECURE will be seen as false."` EnableTLS bool `yaml:"enable_tls" env:"OCIS_EVENTS_ENABLE_TLS;GRAPH_EVENTS_ENABLE_TLS" desc:"Enable TLS for the connection to the events broker. The events broker is the ocis service which receives and delivers events between the services.."` } + +// CORS defines the available cors configuration. +type CORS struct { + AllowedOrigins []string `yaml:"allow_origins" env:"OCIS_CORS_ALLOW_ORIGINS;GRAPH_CORS_ALLOW_ORIGINS" desc:"A comma-separated list of allowed CORS origins. See following chapter for more details: *Access-Control-Allow-Origin* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin"` + AllowedMethods []string `yaml:"allow_methods" env:"OCIS_CORS_ALLOW_METHODS;GRAPH_CORS_ALLOW_METHODS" desc:"A comma-separated list of allowed CORS methods. See following chapter for more details: *Access-Control-Request-Method* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Method"` + AllowedHeaders []string `yaml:"allow_headers" env:"OCIS_CORS_ALLOW_HEADERS;GRAPH_CORS_ALLOW_HEADERS" desc:"A comma-separated list of allowed CORS headers. See following chapter for more details: *Access-Control-Request-Headers* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Headers."` + AllowCredentials bool `yaml:"allow_credentials" env:"OCIS_CORS_ALLOW_CREDENTIALS;GRAPH_CORS_ALLOW_CREDENTIALS" desc:"Allow credentials for CORS.See following chapter for more details: *Access-Control-Allow-Credentials* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials."` +} diff --git a/services/graph/pkg/config/defaults/defaultconfig.go b/services/graph/pkg/config/defaults/defaultconfig.go index ae9bfab02..ed85793c2 100644 --- a/services/graph/pkg/config/defaults/defaultconfig.go +++ b/services/graph/pkg/config/defaults/defaultconfig.go @@ -30,6 +30,12 @@ func DefaultConfig() *config.Config { Addr: "127.0.0.1:9120", Namespace: "com.owncloud.graph", Root: "/graph", + CORS: config.CORS{ + AllowedOrigins: []string{"*"}, + AllowedMethods: []string{"GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"}, + AllowedHeaders: []string{"Authorization", "Origin", "Content-Type", "Accept", "X-Requested-With", "Purge", "Restore"}, + AllowCredentials: true, + }, }, Service: config.Service{ Name: "graph", diff --git a/services/graph/pkg/config/http.go b/services/graph/pkg/config/http.go index 00d4144d9..b9fef1e1f 100644 --- a/services/graph/pkg/config/http.go +++ b/services/graph/pkg/config/http.go @@ -9,4 +9,5 @@ type HTTP struct { Root string `yaml:"root" env:"GRAPH_HTTP_ROOT" desc:"Subdirectory that serves as the root for this HTTP service."` TLS shared.HTTPServiceTLS `yaml:"tls"` APIToken string `yaml:"apitoken" env:"GRAPH_HTTP_API_TOKEN" desc:"An optional API bearer token"` + CORS CORS `yaml:"cors"` } diff --git a/services/graph/pkg/server/http/server.go b/services/graph/pkg/server/http/server.go index c7d520842..83643968a 100644 --- a/services/graph/pkg/server/http/server.go +++ b/services/graph/pkg/server/http/server.go @@ -13,6 +13,7 @@ import ( chimiddleware "github.com/go-chi/chi/v5/middleware" "github.com/go-micro/plugins/v4/events/natsjs" "github.com/owncloud/ocis/v2/ocis-pkg/account" + "github.com/owncloud/ocis/v2/ocis-pkg/cors" ociscrypto "github.com/owncloud/ocis/v2/ocis-pkg/crypto" "github.com/owncloud/ocis/v2/ocis-pkg/middleware" "github.com/owncloud/ocis/v2/ocis-pkg/service/grpc" @@ -98,6 +99,14 @@ func Server(opts ...Option) (http.Service, error) { middleware.Logger( options.Logger, ), + middleware.Cors( + cors.Logger(options.Logger), + cors.AllowedOrigins(options.Config.HTTP.CORS.AllowedOrigins), + cors.AllowedMethods(options.Config.HTTP.CORS.AllowedMethods), + cors.AllowedHeaders(options.Config.HTTP.CORS.AllowedHeaders), + cors.AllowCredentials(options.Config.HTTP.CORS.AllowCredentials), + ), + middleware.Secure, } // how do we secure the api? var requireAdminMiddleware func(stdhttp.Handler) stdhttp.Handler diff --git a/services/ocdav/pkg/command/server.go b/services/ocdav/pkg/command/server.go index 0dabcbbfb..89725b6f8 100644 --- a/services/ocdav/pkg/command/server.go +++ b/services/ocdav/pkg/command/server.go @@ -56,6 +56,10 @@ func Server(cfg *config.Config) *cli.Command { ocdav.Context(ctx), ocdav.Logger(logger.Logger), ocdav.Address(cfg.HTTP.Addr), + ocdav.AllowCredentials(cfg.HTTP.CORS.AllowCredentials), + ocdav.AllowedMethods(cfg.HTTP.CORS.AllowedMethods), + ocdav.AllowedHeaders(cfg.HTTP.CORS.AllowedHeaders), + ocdav.AllowedOrigins(cfg.HTTP.CORS.AllowedOrigins), ocdav.FilesNamespace(cfg.FilesNamespace), ocdav.WebdavNamespace(cfg.WebdavNamespace), ocdav.SharesNamespace(cfg.SharesNamespace), diff --git a/services/ocdav/pkg/config/config.go b/services/ocdav/pkg/config/config.go index e03a095b7..862b4f090 100644 --- a/services/ocdav/pkg/config/config.go +++ b/services/ocdav/pkg/config/config.go @@ -66,6 +66,15 @@ type HTTPConfig struct { Namespace string `yaml:"-"` Protocol string `yaml:"protocol" env:"OCDAV_HTTP_PROTOCOL" desc:"The transport protocol of the HTTP service."` Prefix string `yaml:"prefix" env:"OCDAV_HTTP_PREFIX" desc:"A URL path prefix for the handler."` + CORS `yaml:"cors"` +} + +// CORS defines the available cors configuration. +type CORS struct { + AllowedOrigins []string `yaml:"allow_origins" env:"OCIS_CORS_ALLOW_ORIGINS;OCDAV_CORS_ALLOW_ORIGINS" desc:"A comma-separated list of allowed CORS origins. See following chapter for more details: *Access-Control-Allow-Origin* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin"` + AllowedMethods []string `yaml:"allow_methods" env:"OCIS_CORS_ALLOW_METHODS;OCDAV_CORS_ALLOW_METHODS" desc:"A comma-separated list of allowed CORS methods. See following chapter for more details: *Access-Control-Request-Method* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Method"` + AllowedHeaders []string `yaml:"allow_headers" env:"OCIS_CORS_ALLOW_HEADERS;OCDAV_CORS_ALLOW_HEADERS" desc:"A comma-separated list of allowed CORS headers. See following chapter for more details: *Access-Control-Request-Headers* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Headers."` + AllowCredentials bool `yaml:"allow_credentials" env:"OCIS_CORS_ALLOW_CREDENTIALS;OCDAV_CORS_ALLOW_CREDENTIALS" desc:"Allow credentials for CORS.See following chapter for more details: *Access-Control-Allow-Credentials* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials."` } // Status holds the configurable values for the status.php diff --git a/services/ocdav/pkg/config/defaults/defaultconfig.go b/services/ocdav/pkg/config/defaults/defaultconfig.go index e29abfe39..35d5b3c66 100644 --- a/services/ocdav/pkg/config/defaults/defaultconfig.go +++ b/services/ocdav/pkg/config/defaults/defaultconfig.go @@ -29,6 +29,49 @@ func DefaultConfig() *config.Config { Namespace: "com.owncloud.web", Protocol: "tcp", Prefix: "", + CORS: config.CORS{ + AllowedOrigins: []string{"*"}, + AllowedMethods: []string{ + "OPTIONS", + "HEAD", + "GET", + "PUT", + "POST", + "DELETE", + "MKCOL", + "PROPFIND", + "PROPPATCH", + "MOVE", + "COPY", + "REPORT", + "SEARCH", + }, + AllowedHeaders: []string{ + "Origin", + "Accept", + "Content-Type", + "Depth", + "Authorization", + "Ocs-Apirequest", + "If-None-Match", + "If-Match", + "Destination", + "Overwrite", + "X-Request-Id", + "X-Requested-With", + "Tus-Resumable", + "Tus-Checksum-Algorithm", + "Upload-Concat", + "Upload-Length", + "Upload-Metadata", + "Upload-Defer-Length", + "Upload-Expires", + "Upload-Checksum", + "Upload-Offset", + "X-HTTP-Method-Override", + }, + AllowCredentials: true, + }, }, Service: config.Service{ Name: "ocdav", diff --git a/services/userlog/pkg/server/http/server.go b/services/userlog/pkg/server/http/server.go index 38dd5e2b8..280c5b775 100644 --- a/services/userlog/pkg/server/http/server.go +++ b/services/userlog/pkg/server/http/server.go @@ -8,6 +8,7 @@ import ( "github.com/go-chi/chi/v5" chimiddleware "github.com/go-chi/chi/v5/middleware" "github.com/owncloud/ocis/v2/ocis-pkg/account" + "github.com/owncloud/ocis/v2/ocis-pkg/cors" "github.com/owncloud/ocis/v2/ocis-pkg/middleware" "github.com/owncloud/ocis/v2/ocis-pkg/service/http" "github.com/owncloud/ocis/v2/ocis-pkg/version" @@ -54,6 +55,14 @@ func Server(opts ...Option) (http.Service, error) { account.Logger(options.Logger), account.JWTSecret(options.Config.TokenManager.JWTSecret), ), + middleware.Cors( + cors.Logger(options.Logger), + cors.AllowedOrigins(options.Config.HTTP.CORS.AllowedOrigins), + cors.AllowedMethods(options.Config.HTTP.CORS.AllowedMethods), + cors.AllowedHeaders(options.Config.HTTP.CORS.AllowedHeaders), + cors.AllowCredentials(options.Config.HTTP.CORS.AllowCredentials), + ), + middleware.Secure, } mux := chi.NewMux()