[
https://issues.apache.org/jira/browse/COUCHDB-431?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13091575#comment-13091575
]
Jason Smith commented on COUCHDB-431:
-------------------------------------
Benoit, love the patch. I originally developed _security object support but now
I think it has several problems.
CORS is fundamentally about which *origin* may query cross-site, and whether
the query must be anonymous, or may be authenticated. The best model is to
specify which domains (origins) Couch trusts, and to what degree (anonymous vs.
authenticated).
A couch app lives within CouchDB but not completely within a database. Global
handlers are generally needed for couch apps (/, /_replicate, /_utils,
_session, _uuids). For cross-domain Couch to be useful, the global handlers
must have a compatible CORS policy as the database. _session is particularly
important because if your session on couch has expired, the page on
www.example.com needs a way to log you back in transparently.
Applications can use multiple databases. Once CORS ships, I envision a Cambrian
explosion of couch services and Javascript APIs to add couch features to any
web page. Many apps will provide one database per user. Keeping _security
synchronized will be one extra hurdle for developers to clear.
Finally, CORS is security-sensitive. I would hate to ship an XSS security
vulnerability. In your patch, set_default_cors_headers seems to set
Access-Control-Allow-Origin: $your_origin; Access-Control-Allow-Credentials:
true. Those headers mean that any site on the Internet can force any user to
perform any query on the Couch, with their session cookie. That is probably
undesired. I have not audited your patch completely so perhaps I am wrong.
At this point, I wonder if you agree with me that DB _security settings could
be omitted for this time, and perhaps added later?
> Support cross domain XMLHttpRequest (XHR) calls by implementing Access
> Control spec
> -----------------------------------------------------------------------------------
>
> Key: COUCHDB-431
> URL: https://issues.apache.org/jira/browse/COUCHDB-431
> Project: CouchDB
> Issue Type: New Feature
> Components: HTTP Interface
> Affects Versions: 0.9
> Reporter: James Burke
> Assignee: Benoit Chesneau
> Priority: Minor
> Fix For: 1.2
>
> Attachments: 0001-cors-support.-should-fix-COUCHDB-431-2.patch,
> 0001-cors-support.-should-fix-COUCHDB-431.patch,
> 0001-cors-support.-should-fix-COUCHDB-431.patch,
> A_0001-Generalize-computing-the-appropriate-headers-for-any.patch,
> A_0002-Send-server-headers-for-externals-responses.patch,
> A_0003-Usably-correct-w3c-CORS-headers-for-valid-requests.patch,
> A_0004-Respond-to-CORS-preflight-checks-HTTP-OPTIONS.patch, cors.html,
> test_cors2-1.tgz, test_cors2.tgz
>
>
> Historically, browsers have been restricted to making XMLHttpRequests (XHRs)
> to the same origin (domain) as the web page making the request. However, the
> latest browsers now support cross-domain requests by implementing the Access
> Control spec from the W3C:
> http://dev.w3.org/2006/waf/access-control/
> In order to keep older servers safe that assume browsers only do same-domain
> requests, the Access Control spec requires the server to opt-in to allow
> cross domain requests by the use of special HTTP headers and supporting some
> "pre-flight" HTTP calls.
> Why should CouchDB support this: in larger, high traffic site, it is common
> to serve the static UI files from a separate, differently scaled server
> complex than the data access/API server layer. Also, there are some API
> services that are meant to be centrally hosted, but allow API consumers to
> use the API from different domains. In these cases, the UI in the browser
> would need to do cross domain requests to access CouchDB servers that act as
> the API/data access server layer.
> JSONP is not enough in these cases since it is limited to GET requests, so no
> POSTing or PUTing of documents.
> Some information from Firefox's perspective (functionality available as of
> Firefox 3.5):
> https://developer.mozilla.org/en/HTTP_access_control
> And information on Safari/Webkit (functionality in latest WebKit and Safari
> 4):
> http://developer.apple.com/safari/library/documentation/AppleApplications/Conceptual/SafariJSProgTopics/Articles/XHR.html
> IE 8 also uses the Access Control spec, but the requests have to go through
> their XDomainRequest object (XDR):
> http://msdn.microsoft.com/en-us/library/cc288060%28VS.85%29.aspx
> and I thought IE8 only allowed GET or POST requests through their XDR.
> But as far as CouchDB is concerned, implementing the Access Control headers
> should be enough, and hopefully IE 9 will allow normal xdomain requests via
> XHR.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
