#SummitNow CORS 6 Nov 2013 / 14 Nov 2013 Jared Ottley / Alfresco Software

#SummitNow CORS 6 Nov 2013 / 14 Nov 2013 Jared Ottley / Alfresco Software

#SummitNow What is CORS? Cross-Origin Resource Sharing Cross Domain AJAX Calls Implemented in Browser and Server 3

#SummitNow What Browsers Support CORS? Partial 8 &

#SummitNow How Does CORS Work? Nothing to implement in your javascript. The Browser & the Server do the heavy lifting. 5

#SummitNow How Does CORS Work? 6 Browser OPTIONS API Request

#SummitNow Example Code $.ajax ({ type: ”HTTP METHOD”, url: “Place to go to”, dataType: 'json’, async: false, data: '{}', beforeSend: function (xhr){ xhr.setRequestHeader('Authorization', setAuthTokenHere() }, success: function (response){ //do something }, failure: function (response) { //do something } }); 7

#SummitNow What About the Server Side? Alfresco does not ship with CORS support. Alfresco uses CORS as part of “Alfresco for Salesforce” to talk to Alfresco Cloud. 8

#SummitNow How to Enable CORS in Alfresco Add the following jars to WEB-INF/lib cors-filter java-property-utils Both can be found at 9

#SummitNow How to Enable CORS in Alfresco Modify WEB-INF/web.xml CORS com.thetransactioncompany.cors.CORSFilter CORS /service/* 10

#SummitNow How to Enable CORS in Alfresco What services will be called by your app? CORS /service/* /cmisatom/* /cmisbrowser/* 11

#SummitNow How to Enable CORS in Alfresco 12 Browser OPTIONS API Request Authentication

#SummitNow Filter can be placed anywhere in web.xml However… Filter mapping MUST be before authentication filters How to Enable CORS in Alfresco 13

#SummitNow How to Enable CORS in Alfresco Place after Global Localization Filter but before CMIS security context cleaning filter. This is true for 4.2…but may not be true for other versions of Alfresco. By rule BEFORE any security/authentication filters 14

#SummitNow Filter Configuration By default the CORS Filter will apply a "public access" CORS policy, allowing all cross-site requests through (including credentials/cookies). Leaving the CORS Filter at this setting would actually be fine for most situations as CORS is not about adding server security; its primary intent is to protect the browser - the legitimate JavaScript apps running in it and the user's confidential data, such as cookies. 15

#SummitNow Filter Configuration (cont.) cors.configurationFile properties file Setting the location using System Property (-D) init-param Or Individual init-param 16

#SummitNow Filter Configuration (cont.) Do not change the following defaults: cors.allowGenericHttpRequests {true|false} defaults to true cors.supportsCredentials {true|false} defaults to true. cors.maxAge {int} defaults to -1 (unspecified) How long should pre-flight requests be cached. Recommended value is 3600 (1 hour) 17

#SummitNow Filter Configuration (cont.) cors.allowOrigin {"*"|origin-list} defaults to * Which calling domains are allowed? ex: Returns 403 if the domain is not allowed 18

#SummitNow Filter Configuration (cont.) cors.allowSubdomains {true|false} defaults to false Your application may run in a hosted service where the subdomain is dynamically assigned ex. salesforce.com ex. 19

#SummitNow Filter Configuration (cont.) cors.supportedMethods {method-list} defaults to "GET, POST, HEAD, OPTIONS” cors.supportedHeaders {"*"|header-list} defaults to * origin, authorization, accept 20

#SummitNow Filter Configuration (cont.) cors.exposedHeaders {header-list} defaults to empty list Response headers limited to: Cache- Control, Content-Language, Content- Type, Expires, Last-Modified Pragma Add additional headers to be exposed 21

#SummitNow Demo 22

#SummitNow CORS Resources

#SummitNow CORS Resources