Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of bchesneau@gmail.com
 designates 74.125.83.52 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAJNb-9rYnfwGLVr12zB8k1kRpDwGFQnb_Zukdr7vyFrdBBh0VQ@mail.gmail.com>
References: 
 <CAJNb-9rYnfwGLVr12zB8k1kRpDwGFQnb_Zukdr7vyFrdBBh0VQ@mail.gmail.com>
Date: Mon, 28 Nov 2011 11:50:08 +0100
Message-ID: 
 <CAJNb-9q_CwWkrDAxLDoAwhpti5af+Jwe2jHqKGYW0xtirTet0A@mail.gmail.com>
Subject: Re: CORS feature.
From: Benoit Chesneau <bchesneau@gmail.com>
To: dev@couchdb.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Mon, Nov 28, 2011 at 11:38 AM, Benoit Chesneau <bchesneau@gmail.com> wro=
te:
> Hi,
> We had a great discussion today Jason, Randall and me about the CORS
> feature [1] .
> I'm positing here the current result that you can find on friendpaste
> [2] too. I think it's
> a pretty good start and we can begin to code it. Implementation is
> mostly a merge
> between jason proposal and mine imo. Thoughts ?
>
> - beno=EEt
>
> [1] https://issues.apache.org/jira/browse/COUCHDB-431
> [2] http://friendpaste.com/4q1zeNUEtPFS7XbioPYYzM
>
> guidelinees :
> ------------------
>
> =A0 =A0- rules shoudl be based on host .
> =A0 =A0- rules depending on the resource :
> =A0 =A0 =A0- server : rules defined in .ini
> =A0 =A0 =A0- db : rules defined in .db
>
> =A0 =A0- default cors policy :
> =A0 =A0 =A0 =A0- allows credential =3D false
> =A0 =A0 =A0 =A0- cors enabled
> =A0 =A0- cors can be disabled globaly
>
>
>
> =A0 =A0rules definiton :
>
> =A0 =A0global wide
>
> =A0 =A0[httpd]
> =A0 =A0cors_enabled =3D true
>
> =A0 =A0[origins]
> =A0 =A0domain.tld =3D http://origin.tld, https://origin.tld
>
> =A0 =A0[http://origin.tld]
> =A0 =A0allow_methods =3D GET, POST
> =A0 =A0allow_headers =3D x-couchdb-...
> =A0 =A0allow_credentials =3D false
>
>
> =A0 =A0[https://origin.tld]
> =A0 =A0allow_methods =3D GET, PUT, POST, DELETE
> =A0 =A0allow_headers =3D x-couchdb-...
> =A0 =A0allow_credentials =3D true
> =A0 =A0allow_server_admins =3D true
> =A0 =A0max-age =3D 36000
>
>
> =A0 =A0ond db _security object :
>
>
> =A0 =A0{
> =A0 =A0 =A0 =A0"origins": {
> =A0 =A0 =A0 =A0 =A0 =A0"domain.tld": [
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0{"http://origin.tld": { "allow_methods": "=
GET, POST",
> =A0 =A0...}
> =A0 =A0 =A0 =A0 =A0 =A0]
> =A0 =A0 =A0 =A0}
> =A0 =A0}
>
>
>
> =A0 =A0work flow :
>
> =A0 =A0is origins list empty in ini
> =A0 =A0yes -> is admin party set ?
> =A0 =A0 =A0yes -> return "*" , credentials false (with a good caching pol=
icy)
> =A0 =A0 =A0no -> stop
> =A0 =A0no ->
> =A0 =A0 =A0is origin in .ini ?
> =A0 =A0 =A0yes ->
> =A0 =A0 =A0 =A0is origin in list ?
> =A0 =A0 =A0 =A0yes ->
> =A0 =A0 =A0 =A0 =A0set the cors headers based on .ini
> =A0 =A0 =A0 =A0 =A0then are we on a db resource ?
> =A0 =A0 =A0 =A0 =A0 =A0yes ->
> =A0 =A0 =A0 =A0 =A0 =A0 =A0apply the intersection of .ini with db resourc=
e
> =A0 =A0 =A0 =A0no -> stop
> =A0 =A0 =A0no ->
>


quick not about hosts. It should be abble to set '*' to manage origins
for any hosts.

- beno=EEt