<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">To see how I did it I have a pull request here.</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Thanks to Kate for pointing me out.</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><a href="https://github.com/mozilla/makedrive/pull/137">https://github.com/mozilla/makedrive/pull/137</a></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div> <div id="bloop_sign_1406066081737699072" class="bloop_sign"><div style="font-family:helvetica,arial;font-size:13px">-- <br>Ali Al Dallal<br>Sent with Airmail</div></div> <br><p style="color:#000;">On July 22, 2014 at 5:32:55 PM, Kate Hudson (<a href="mailto:kate@mozillafoundation.org">kate@mozillafoundation.org</a>) wrote:</p> <blockquote type="cite" class="clean_bq"><span><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div></div><div>
<title></title>
One thing I notice is that you need to add
'Access-Control-Allow-Headers’, and include a list of all headers
you’re sending
<div><br></div>
<div>- K<br>
<div><br></div>
<div>
<div>On Jul 22, 2014, at 5:31 PM, Ali Al Dallal <<a href="mailto:alihuda2002@gmail.com">alihuda2002@gmail.com</a>>
wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; padding: 1em; margin: auto; background-color: rgb(254, 254, 254); font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<p style="margin: 15px 0px;">The problem that I’m facing right now
is that I’m trying to access MakeDrive server using Appmaker and
Nimble (Brackets running in web apache).</p>
<p style="margin: 15px 0px;">I have both running locally
appmaker=localhost:5001 and nimble=localhost:9001</p>
<p style="margin: 15px 0px;">And I have this code</p>
<pre style="margin: 15px 0px; font-family: Monaco; font-size: 10pt; border-top-left-radius: 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; background-color: rgb(248, 248, 248); color: inherit; border: 1px solid rgb(204, 204, 204); overflow: auto; padding: 4px 8px;">
<code style="font-family: Monaco; font-size: 10pt; border-top-left-radius: 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; background-color: rgb(248, 248, 248); color: inherit; border: 0px; margin: 0px; padding: 0px;">crossOriginHandler: function( req, res, next ) {
f (env.get("ALLOWED_CORS_DOMAINS").indexOf(req.headers.origin) > -1) {
res.header('Access-Control-Allow-Origin', req.headers.origin);
res.header('Access-Control-Allow-Credentials', true);
}
next();
},
</code>
</pre>
<p style="margin: 15px 0px;">The problem here is that only Nimble
can access but Appmaker getting this error</p>
<p style="margin: 15px 0px;"><code style="font-family: Monaco; font-size: 10pt; border-top-left-radius: 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; background-color: rgb(248, 248, 248); color: inherit; border: 1px solid rgb(234, 234, 234); margin: 0px 2px; padding: 0px 5px;">
Imported resource from origin '<a href="http://localhost:9090'" style="color: rgb(65, 131, 196); background-color: inherit; text-decoration: none;">http://localhost:9090'</a><span class="Apple-converted-space"> </span>has
been blocked from loading by Cross-Origin Resource Sharing policy:
No 'Access-Control-Allow-Origin' header is present on the requested
resource. Origin '<a href="http://localhost:5001'" style="color: rgb(65, 131, 196); background-color: inherit; text-decoration: none;">http://localhost:5001'</a><span class="Apple-converted-space"> </span>is
therefore not allowed access.</code></p>
<p style="margin: 15px 0px;">–<br>
Ali Al Dallal<br>
Sent with Airmail</p>
<p style="margin: 15px 0px;">On July 22, 2014 at 5:21:35 PM, Jon
Buckley (<a href="mailto:jon@mozillafoundation.org">jon@mozillafoundation.org</a>)
wrote:</p>
<p style="margin: 15px 0px;">Ali, can you explain the CORS issues
in depth or point me at a bug? We have multiple CORS domains set on
our events API: <a href="https://github.com/mozilla/webmaker-events-service/blob/master/routes/cors.js">
https://github.com/mozilla/webmaker-events-service/blob/master/routes/cors.js</a></p>
<p style="margin: 15px 0px;">On Jul 22, 2014, at 4:42 PM, David
Humphrey<span class="Apple-converted-space"> </span><a href="mailto:david.humphrey@senecacollege.ca" style="color: rgb(65, 131, 196); background-color: inherit; text-decoration: none;">david.humphrey@senecacollege.ca</a><span class="Apple-converted-space"> </span>wrote:</p>
<blockquote style="margin: 15px 0px;">
<p style="margin: 0px 0px 15px;">We need a hand getting the
MakeDrive authentication story figured out, specifically so we can
work in a Webmaker Auth environment. I’ve had bits and pieces of
this conversation with wex/jbuck, but I need more help.</p>
<p style="margin: 15px 0px;">MakeDrive is:</p>
<ul style="margin: 15px 0px;">
<li style="margin: 15px 0px;">
<p style="margin: 15px 0px;">a Webmaker service that doesn’t manage
authentication (you don’t sign-in/sign-out of MakeDrive), but it
(currently) uses Webmaker auth info stored on the session
cookie.</p>
</li>
<li style="margin: 15px 0px;">
<p style="margin: 15px 0px;">based on WebSockets. Everything
involved in syncing happens over a socket.</p>
</li>
<li style="margin: 15px 0px;">
<p style="margin: 15px 0px;">but the very first connection has to
be to get a token to give the socket, so we know that you are who
you say you are.</p>
</li>
</ul>
<p style="margin: 15px 0px;">At the moment, we do this:</p>
<p style="margin: 15px 0px;">1) user does a GET request to
/api/sync and the server looks for a Webmaker Auth cookie to
decrypt and get the username. If it’s found, a sync token (uuid) is
stored and returned. If not, 401.</p>
<p style="margin: 15px 0px;">2) user takes sync token from step 1,
and connects to web socket. First protocol message is a handshake
with that token.</p>
<p style="margin: 15px 0px;">3) server inspects token from user and
compares to token it stored in step 1). If they match, the sync
protocol continues, otherwise the server socket hangs up.</p>
<p style="margin: 15px 0px;">By its nature, MakeDrive is cross
origin for every app we’ll write. Imagine it lives on <a href="http://drive.webmaker.org">drive.webmaker.org</a> and you’re
working on building <a href="http://awesome.webmaker.org">awesome.webmaker.org</a>. Or, your
life could be even harder and you could be Atul working in an
extension. No matter who you are, you don’t live on <a href="http://drive.webmaker.org">drive.webmaker.org</a>, so all your
calls are cross origin.</p>
<p style="margin: 15px 0px;">We’re trying to get the CORS headers
right, but it seems like we can only set a single CORS domain to
whitelist. Ali has more details and can reply.</p>
<p style="margin: 15px 0px;">Trying to debug this I’m starting to
wonder if we’ve just got to improve how we’re doing this. There was
talk about having a oauth type flow for Webmaker authentication,
and then we could use that to pass credentials to /api/sync on the
query string, and get the token that way without needing to bother
with session cookies.</p>
<p style="margin: 15px 0px;">Can I get some help to figure this
out? It’s going to block any serious uses of MakeDrive, and we’re
pretty much ready to get an MVP deployed by the end of the
week.</p>
<p style="margin: 15px 0px;">Dave</p>
<hr style="height: 0.2em; border: 0px; color: rgb(204, 204, 204); background-color: rgb(204, 204, 204);">
<p style="margin: 15px 0px 0px;">Webmaker-dev mailing list <a href="mailto:Webmaker-dev@mozilla.org">Webmaker-dev@mozilla.org</a>
<a href="https://mail.mozilla.org/listinfo/webmaker-dev">https://mail.mozilla.org/listinfo/webmaker-dev</a></p>
</blockquote>
<hr style="height: 0.2em; border: 0px; color: rgb(204, 204, 204); background-color: rgb(204, 204, 204);">
<p style="margin: 15px 0px;">Webmaker-dev mailing list <a href="mailto:Webmaker-dev@mozilla.org">Webmaker-dev@mozilla.org</a>
<a href="https://mail.mozilla.org/listinfo/webmaker-dev">https://mail.mozilla.org/listinfo/webmaker-dev</a></p>
_______________________________________________<br>
Webmaker-dev mailing list<br>
<a href="mailto:Webmaker-dev@mozilla.org" style="color: rgb(65, 131, 196); background-color: inherit; text-decoration: none;">
Webmaker-dev@mozilla.org</a><br>
<a href="https://mail.mozilla.org/listinfo/webmaker-dev" style="color: rgb(65, 131, 196); background-color: inherit; text-decoration: none;">
https://mail.mozilla.org/listinfo/webmaker-dev</a><br></div>
</blockquote>
</div>
<br></div>
<hr></div></div></span></blockquote></body></html>