Page MenuHomePhabricator

Support for OPTIONS verb (preflight) in API requests when doing CORS
Closed, ResolvedPublic

Description

Author: jgonera

Description:
Preflight needs to be supported to use progress events[1]. The spec says they need a preflight to work[2].

[1] https://dvcs.w3.org/hg/progress/raw-file/tip/Overview.html
[2] http://www.w3.org/TR/cors/#cors-api-specification-response


Version: 1.21.x
Severity: normal
See Also:
https://bugzilla.wikimedia.org/show_bug.cgi?id=41731

Details

Reference
bz44921

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 22 2014, 1:22 AM
bzimport added a project: MediaWiki-API.
bzimport set Reference to bz44921.

I see two potential issues here (and one client issue).

0. The API requires the "origin" URL parameter be included with the OPTIONS request. In other words, it must be in the URL rather than in the POST body. This is a client issue.

  1. The API will execute the query for an OPTIONS request for an allowed query, when it should wait for the followup GET or POST. This should be taken care of by gerrit change 51007.
  1. WMF's squids appear to reject the OPTIONS query before it ever gets to the API. That's a matter for a different bug, probably bug 41731.
Yurik added a comment.Feb 26 2013, 9:32 PM

merged Gerrit change #51007.

I'm going to mark this as fixed; the squid issue is already tracked in bug 41731.

Change 97836 had a related patch set uploaded by JGonera:
Uncomment and fix upload progress event test for Api

https://gerrit.wikimedia.org/r/97836

(reset bug to "fixed", that patch is dependent on this bug but not really about it)