Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HTTP JSON API should answer OPTIONS prerequests #2782

Closed
ghost opened this issue Sep 5, 2019 · 9 comments · Fixed by #3460
Closed

HTTP JSON API should answer OPTIONS prerequests #2782

ghost opened this issue Sep 5, 2019 · 9 comments · Fixed by #3460
Labels
component/json-api HTTP JSON API component/ledger Sandbox and Ledger API team/ledger-clients Related to the Ledger Clients team's components.

Comments

@ghost
Copy link

ghost commented Sep 5, 2019

Apparently most browsers send OPTIONS preflight request before they send a header containing the 'Authorization' header for JWT. However the HTTP-JSON API doesn't answer those. Here's a request from my browser:

Host: 127.0.0.1:7575
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Referer: http://localhost:3000/
Origin: http://localhost:3000

This breaks web-frontends trying to fetch data from the service. Here's a discussion on the issue: https://stackoverflow.com/questions/44245588/how-to-send-authorization-header-with-axios

@ghost ghost assigned leo-da Sep 5, 2019
@leo-da leo-da added the component/ledger Sandbox and Ledger API label Sep 5, 2019
@leo-da leo-da added this to the HTTP JSON API First Version milestone Sep 5, 2019
@leo-da
Copy link
Contributor

leo-da commented Sep 5, 2019

An example OPTIONS request:

OPTIONS /contracts/search HTTP/1.1
Host: 127.0.0.1:7575
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Referer: http://localhost:3000/
Origin: http://localhost:3000

@leo-da
Copy link
Contributor

leo-da commented Sep 6, 2019

adding OPTIONS support is not a problem. However OPTIONS pre-request is used as part of the CORS mechanism (Cross-Origin resource Sharing), which we don't want to support. @Robin-da set up a reverse proxy, this solved the original issue. Closing this, unless there are other reasons to support OPTIONS method.

@leo-da leo-da closed this as completed Sep 6, 2019
@cocreature
Copy link
Contributor

Why do you not want to support CORS? Having the JSON API server run on a different host than the server serving your frontend seems quite common and often you don’t have enough control over the frontend server to add a reverse proxy, e.g., if you support CORS I can host a frontend on github pages which is really convenient.

@hurryabit
Copy link
Contributor

Why do we not want to support CORS? Basically everybody writing a DAML-based app using the JSON API will have this problem. Having to setup a reverse proxy doesn't exactly lower the barrier to entry.
cc @gerolf-da

@hurryabit hurryabit reopened this Sep 9, 2019
@leo-da
Copy link
Contributor

leo-da commented Sep 9, 2019

@cocreature @hurryabit we have considered adding CORS support. @da-tanabe had a slack conversation with @bame-da and we agreed that the risks and complexity added by CORS support are not worth the effort. There are tons of web dev options to get around the problem without the reverse proxy. @da-tanabe provided the corresponding links, which we can add to an FAQ at some point.

The simplest solution would be to support dev only --static-resource-directory.

Again, we are open for discussion.

@leo-da
Copy link
Contributor

leo-da commented Nov 13, 2019

@hurryabit now you can start JSON API daemon with --static-content "directory=/home/leos/tmp/html,prefix=static this will serve static content from /home/leos/tmp/html directory and map it into /static/*

Is this sufficient or do you really need CORS support?

@leo-da
Copy link
Contributor

leo-da commented Nov 13, 2019

--static-content is NOT recommended for PROD deployments.

@hurryabit
Copy link
Contributor

@leo-da Serving static content during development is enough. I think we don't wont to get into the business of building a webserver. Thank you very much for taking care of this.

@mergify mergify bot closed this as completed in #3460 Nov 18, 2019
stefanobaghino-da added a commit that referenced this issue Nov 20, 2019
Document new process in CONTRIBUTING.md,
.github/pull_request_template.md and unreleased.rst (for good measure)

Report the previous changelog additions here so that they're not lost in
the mist of times.

CHANGELOG

- [DAML Stdlib] Added the ``NumericScale`` typeclass, which improves the type inference for Numeric literals, and helps catch the creation of out-of-bound Numerics earlier in the compilation process.

- [DAML Triggers] ``emitCommands`` now accepts an additional argument
  that allows you to mark contracts as pending. Those contracts will
  be automatically filtered from the result of ``getContracts`` until
  we receive the corresponding completion/transaction.

- [Navigator] Fixed a bug where Navigator becomes unresponsive if the ledger does not contain any DAML packages.

- [Ledger-API] Add field ``gen_map`` in Protobuf definition for ledger
  api values. This field is used to support generic maps, an new
  feature currently in development.  See issue
  #3356 for more details
  about generic maps.

  The Ledger API will send no messages where this field is set, when
  using a stable version of DAML-LF.  However the addition of this
  field may cause pattern-matching exhaustive warnings in the code of
  ledger API clients. Those warnings can be safely ignored until
  GenMap is made stable in an upcoming version of DAML-LF.

- [JSON API - Experimental] CLI configuration to enable serving static content as part of the JSON API daemon:
  ``--static-content "directory=/full/path,prefix=static"``
  This configuration is NOT recommended for production deployment. See issue #2782.

- [Extractor] The app can now work against a Ledger API server that requires client authentication. See `issue #3157 <https://github.com/digital-asset/daml/issues/3157>`__.
- [DAML Script] This release contains a first version of an experimental DAML script
   feature that provides a scenario-like API that is run against an actual ledger.
- [DAML Compiler] The default DAML-LF version is now 1.7. You can
  still produce DAML-LF 1.6 by passing ``--target=1.6`` to ``daml
  build``.

- [JSON API - Experimental] The database schema has changed; if using
  ``--query-store-jdbc-config``, you must rebuild the database by adding
  ``,createSchema=true``.
  See `issue #3461 <https://github.com/digital-asset/daml/pull/3461>`_.

- [JSON API - Experimental] Terminate process immediately after creating schema. See issue #3386.

- [DAML Stdlib] ``fromAnyChoice`` and ``fromAnyContractKey`` now take
  the template type into account.
stefanobaghino-da added a commit that referenced this issue Nov 20, 2019
Document new process in CONTRIBUTING.md,
.github/pull_request_template.md and unreleased.rst (for good measure)

Report the previous changelog additions here so that they're not lost in
the mist of times.

CHANGELOG_BEGIN

- [DAML Stdlib] Added the ``NumericScale`` typeclass, which improves the type inference for Numeric literals, and helps catch the creation of out-of-bound Numerics earlier in the compilation process.

- [DAML Triggers] ``emitCommands`` now accepts an additional argument
  that allows you to mark contracts as pending. Those contracts will
  be automatically filtered from the result of ``getContracts`` until
  we receive the corresponding completion/transaction.

- [Navigator] Fixed a bug where Navigator becomes unresponsive if the ledger does not contain any DAML packages.

- [Ledger-API] Add field ``gen_map`` in Protobuf definition for ledger
  api values. This field is used to support generic maps, an new
  feature currently in development.  See issue
  #3356 for more details
  about generic maps.

  The Ledger API will send no messages where this field is set, when
  using a stable version of DAML-LF.  However the addition of this
  field may cause pattern-matching exhaustive warnings in the code of
  ledger API clients. Those warnings can be safely ignored until
  GenMap is made stable in an upcoming version of DAML-LF.

- [JSON API - Experimental] CLI configuration to enable serving static content as part of the JSON API daemon:
  ``--static-content "directory=/full/path,prefix=static"``
  This configuration is NOT recommended for production deployment. See issue #2782.

- [Extractor] The app can now work against a Ledger API server that requires client authentication. See `issue #3157 <https://github.com/digital-asset/daml/issues/3157>`__.
- [DAML Script] This release contains a first version of an experimental DAML script
   feature that provides a scenario-like API that is run against an actual ledger.
- [DAML Compiler] The default DAML-LF version is now 1.7. You can
  still produce DAML-LF 1.6 by passing ``--target=1.6`` to ``daml
  build``.

- [JSON API - Experimental] The database schema has changed; if using
  ``--query-store-jdbc-config``, you must rebuild the database by adding
  ``,createSchema=true``.
  See `issue #3461 <https://github.com/digital-asset/daml/pull/3461>`_.

- [JSON API - Experimental] Terminate process immediately after creating schema. See issue #3386.

- [DAML Stdlib] ``fromAnyChoice`` and ``fromAnyContractKey`` now take
  the template type into account.

CHANGELOG_END
stefanobaghino-da added a commit that referenced this issue Nov 20, 2019
Document new process in CONTRIBUTING.md,
.github/pull_request_template.md and unreleased.rst (for good measure)

Report the previous changelog additions here so that they're not lost in
the mist of times.

CHANGELOG_BEGIN

- [DAML Stdlib] Added the ``NumericScale`` typeclass, which improves the type inference for Numeric literals, and helps catch the creation of out-of-bound Numerics earlier in the compilation process.

- [DAML Triggers] ``emitCommands`` now accepts an additional argument
  that allows you to mark contracts as pending. Those contracts will
  be automatically filtered from the result of ``getContracts`` until
  we receive the corresponding completion/transaction.

- [Navigator] Fixed a bug where Navigator becomes unresponsive if the ledger does not contain any DAML packages.

- [Ledger-API] Add field ``gen_map`` in Protobuf definition for ledger
  api values. This field is used to support generic maps, an new
  feature currently in development.  See issue
  #3356 for more details
  about generic maps.

  The Ledger API will send no messages where this field is set, when
  using a stable version of DAML-LF.  However the addition of this
  field may cause pattern-matching exhaustive warnings in the code of
  ledger API clients. Those warnings can be safely ignored until
  GenMap is made stable in an upcoming version of DAML-LF.

- [JSON API - Experimental] CLI configuration to enable serving static content as part of the JSON API daemon:
  ``--static-content "directory=/full/path,prefix=static"``
  This configuration is NOT recommended for production deployment. See issue #2782.

- [Extractor] The app can now work against a Ledger API server that requires client authentication. See `issue #3157 <https://github.com/digital-asset/daml/issues/3157>`__.
- [DAML Script] This release contains a first version of an experimental DAML script
   feature that provides a scenario-like API that is run against an actual ledger.
- [DAML Compiler] The default DAML-LF version is now 1.7. You can
  still produce DAML-LF 1.6 by passing ``--target=1.6`` to ``daml
  build``.

- [JSON API - Experimental] The database schema has changed; if using
  ``--query-store-jdbc-config``, you must rebuild the database by adding
  ``,createSchema=true``.
  See `issue #3461 <https://github.com/digital-asset/daml/pull/3461>`_.

- [JSON API - Experimental] Terminate process immediately after creating schema. See issue #3386.

- [DAML Stdlib] ``fromAnyChoice`` and ``fromAnyContractKey`` now take
  the template type into account.

CHANGELOG_END
stefanobaghino-da added a commit that referenced this issue Nov 20, 2019
Document new process in CONTRIBUTING.md,
.github/pull_request_template.md and unreleased.rst (for good measure)

Report the previous changelog additions here so that they're not lost in
the mist of times.

CHANGELOG_BEGIN

- [DAML Stdlib] Added the ``NumericScale`` typeclass, which improves the type inference for Numeric literals, and helps catch the creation of out-of-bound Numerics earlier in the compilation process.

- [DAML Triggers] ``emitCommands`` now accepts an additional argument
  that allows you to mark contracts as pending. Those contracts will
  be automatically filtered from the result of ``getContracts`` until
  we receive the corresponding completion/transaction.

- [Navigator] Fixed a bug where Navigator becomes unresponsive if the ledger does not contain any DAML packages.

- [Ledger-API] Add field ``gen_map`` in Protobuf definition for ledger
  api values. This field is used to support generic maps, an new
  feature currently in development.  See issue
  #3356 for more details
  about generic maps.

  The Ledger API will send no messages where this field is set, when
  using a stable version of DAML-LF.  However the addition of this
  field may cause pattern-matching exhaustive warnings in the code of
  ledger API clients. Those warnings can be safely ignored until
  GenMap is made stable in an upcoming version of DAML-LF.

- [JSON API - Experimental] CLI configuration to enable serving static content as part of the JSON API daemon:
  ``--static-content "directory=/full/path,prefix=static"``
  This configuration is NOT recommended for production deployment. See issue #2782.

- [Extractor] The app can now work against a Ledger API server that requires client authentication. See `issue #3157 <https://github.com/digital-asset/daml/issues/3157>`__.
- [DAML Script] This release contains a first version of an experimental DAML script
   feature that provides a scenario-like API that is run against an actual ledger.
- [DAML Compiler] The default DAML-LF version is now 1.7. You can
  still produce DAML-LF 1.6 by passing ``--target=1.6`` to ``daml
  build``.

- [JSON API - Experimental] The database schema has changed; if using
  ``--query-store-jdbc-config``, you must rebuild the database by adding
  ``,createSchema=true``.
  See `issue #3461 <https://github.com/digital-asset/daml/pull/3461>`_.

- [JSON API - Experimental] Terminate process immediately after creating schema. See issue #3386.

- [DAML Stdlib] ``fromAnyChoice`` and ``fromAnyContractKey`` now take
  the template type into account.

CHANGELOG_END
mergify bot pushed a commit that referenced this issue Nov 20, 2019
* Start working on getting rid of unreleased.rst

Document new process in CONTRIBUTING.md,
.github/pull_request_template.md and unreleased.rst (for good measure)

Report the previous changelog additions here so that they're not lost in
the mist of times.

CHANGELOG_BEGIN

- [DAML Stdlib] Added the ``NumericScale`` typeclass, which improves the type inference for Numeric literals, and helps catch the creation of out-of-bound Numerics earlier in the compilation process.

- [DAML Triggers] ``emitCommands`` now accepts an additional argument
  that allows you to mark contracts as pending. Those contracts will
  be automatically filtered from the result of ``getContracts`` until
  we receive the corresponding completion/transaction.

- [Navigator] Fixed a bug where Navigator becomes unresponsive if the ledger does not contain any DAML packages.

- [Ledger-API] Add field ``gen_map`` in Protobuf definition for ledger
  api values. This field is used to support generic maps, an new
  feature currently in development.  See issue
  #3356 for more details
  about generic maps.

  The Ledger API will send no messages where this field is set, when
  using a stable version of DAML-LF.  However the addition of this
  field may cause pattern-matching exhaustive warnings in the code of
  ledger API clients. Those warnings can be safely ignored until
  GenMap is made stable in an upcoming version of DAML-LF.

- [JSON API - Experimental] CLI configuration to enable serving static content as part of the JSON API daemon:
  ``--static-content "directory=/full/path,prefix=static"``
  This configuration is NOT recommended for production deployment. See issue #2782.

- [Extractor] The app can now work against a Ledger API server that requires client authentication. See `issue #3157 <https://github.com/digital-asset/daml/issues/3157>`__.
- [DAML Script] This release contains a first version of an experimental DAML script
   feature that provides a scenario-like API that is run against an actual ledger.
- [DAML Compiler] The default DAML-LF version is now 1.7. You can
  still produce DAML-LF 1.6 by passing ``--target=1.6`` to ``daml
  build``.

- [JSON API - Experimental] The database schema has changed; if using
  ``--query-store-jdbc-config``, you must rebuild the database by adding
  ``,createSchema=true``.
  See `issue #3461 <https://github.com/digital-asset/daml/pull/3461>`_.

- [JSON API - Experimental] Terminate process immediately after creating schema. See issue #3386.

- [DAML Stdlib] ``fromAnyChoice`` and ``fromAnyContractKey`` now take
  the template type into account.

CHANGELOG_END

* Document new release process to gather changelog additions

* Change the release script to ignore unreleased.rst

* Remove spurious unreleased.rst lines

* Transition to use tags

* Document new way to get changelog additions with tags

* Update release/RELEASE.md

Co-Authored-By: Gary Verhaegen <gary.verhaegen@digitalasset.com>

* Address #3547 (comment)

* Document correction process

* Add copyright header to unreleased.sh

* Update CONTRIBUTING.md

Co-Authored-By: Gary Verhaegen <gary.verhaegen@digitalasset.com>

* Modify CONTRIBUTING.md after @garyverhaegen-da's proposal

* Make unreleased.sh run per commit and treat tags as case-insensitive

* Fix documentation for replacements
@stefanobaghino-da stefanobaghino-da added component/json-api HTTP JSON API team/ledger-clients Related to the Ledger Clients team's components. labels Aug 31, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
component/json-api HTTP JSON API component/ledger Sandbox and Ledger API team/ledger-clients Related to the Ledger Clients team's components.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants