[Service Bus] ServiceBusAdministrationClient Browser requests do not work unless web security is disabled

[ramya0820]

The ATOM management API currently don't work in the browser unless web security is disabled.

• This is due to a CORS policy error and it looks like the response headers are not being set properly.
  Specifically -> Access-Control-Allow-Origin
• For requests that go via the Azure Portal, this gets set to https://ms.portal.azure.com by the service.
• More investigation is needed by service team; we may need a plan and security threat analysis to address the changes required for this implementation to work in browser for our users.

[ramya0820]

Closing as service side team is informed and engaged

[ramya0820]

Re-opening this as this affects our ability from SDK side - since an end to end browser sample using this feature would work only if web security is disabled in the browser.

Once we have updates from service side, we can use this issue to track investigation/efforts to update/add sample possibly

cc @AlexGhiondea @ramya-rao-a

[HarshaNalluru]

Error seen in the browser

Access to XMLHttpRequest at 'https://<namespace>.servicebus.windows.net/<queue>?api-version=2017-04' from origin 'http://localhost:1234' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

[HarshaNalluru]

Talked to @sadasant on this.

Thoughts after the discussion:
Ideally, the service should provide an option to the users to set the CORS policy on the namespace similar to what storage does.

https://docs.microsoft.com/en-us/rest/api/storageservices/Cross-Origin-Resource-Sharing--CORS--Support-for-the-Azure-Storage-Services?redirectedfrom=MSDN

For testing, we can continue with --disable-web-security flag in karma conf until the service supports enabling CORS rules.

[ramya-rao-a]

What affect does this have on users writing web applications? Is the problem only when they try to add tests for their code?

[HarshaNalluru]

Anybody who's trying to use ServiceBusAdministrationClient directly through the browsers would run into this issue(blocked request), not just testing.
If the service lets users manage/enable CORS rules or allow all the origins by default(*), this issue will be resolved.
Another option is to launch the browser by providing a flag to disable web security, which is not ideal since it is not as secure.

[ramya-rao-a]

Ok, lets document this in the readme for now and then work with the service team in the coming months to see how best to fix this

[abdou89]

Hello team !
is there a fix to the CORS error yet ? i'm currently working on a app that uses the service bus sdk and make calls from the browser but i'm stuck on this , disabling web security is not an option for me ..thanks !

[ramya-rao-a]

Hey @abdou89

No updates yet. We will be revisiting this in the next few months and follow up with the service team on next steps

[TyreeceSimpson]

Hey team,
Is there any update on this as I am in the same position as @abdou89?

[ramya-rao-a]

Hey @TyreeceSimpson

This would require a change from the service side and we don't have an ETA on that. We will try and get this out of their backlog and update this thread if there is any progress

[Jose-27]

Hey @TyreeceSimpson

I am not sure if this applies to @azure/cosmos, but I am facing the same issue regarding CORS in the browser.
Endpoint: <https://{dbname}.documents.azure.com:443
Key=<******>
const client = new CosmosClient({ endpoint, key });

Any updates so far?

[TyreeceSimpson]

@Jose-27

Unfortunately I'm still a bit stuck on this. The only solution that I have seen mentioned is have a proxy between the two.

[ramya-rao-a]

@Jose-27 The npm package for cosmos has a section on CORS which then links to Configure Cross-Origin Resource Sharing for Cosmos. If things still don't work, please log a new issue. This issue here is for tracking the problem for Service Bus

[hybridtechie]

Facing the same issue. Any updates on this? @ramya-rao-a

[jeremymeng]

@hybridtechie if you are using the ServiceBusAdministrationClient from @azure/service-bus package, there is no update from the service team on this. If you are using other packages please log a new issue.

[github-actions]

Hi @ramya0820, we deeply appreciate your input into this project. Regrettably, this issue has remained inactive for over 2 years, leading us to the decision to close it. We've implemented this policy to maintain the relevance of our issue queue and facilitate easier navigation for new contributors. If you still believe this topic requires attention, please feel free to create a new issue, referencing this one. Thank you for your understanding and ongoing support.