Cross domain queries in Web browsers

[macosforgebot]

jan.mate@… originally submitted this as ticket:468

• Owner: @glyph

---

It is impossible to access the calendarserver from javascript due to cross domain security limitations in modern browsers. To allow cross domain queries from javascript based caldav/carddav clients it is important to add several new headers to each response (see http://www.w3.org/TR/cors/).

For example, to use my CardDavMATE client (fully javascript based) the user must patch the calendarserver (see the included patch).

[macosforgebot]

jan.mate@… originally submitted this as attachment:calendarserver_CardDavMATE.diff:⁠ticket:468

• Attachment calendarserver_CardDavMATE.diff (2.8 KB) added

[macosforgebot]

@wsanchez originally submitted this as comment:1:⁠ticket:468

• Owner changed from @wsanchez to @glyph
• Milestone set to CalendarServer-3.x

[macosforgebot]

@wsanchez originally submitted this as comment:2:⁠ticket:468

---

I hate web browsers…

I'm not sure the web2/server.py is appropriate… I assume these values aren't correct for all servers, or you wouldn't need these headers in the first place. Certainly the allowed methods list needs to correspond to what's allowed on the resource being requested.

[macosforgebot]

@wsanchez originally submitted this as comment:3:⁠ticket:468

• Milestone changed from CalendarServer-3.x to Later

[macosforgebot]

jan.mate@… originally submitted this as comment:4:⁠ticket:468

---

Replying to wsanchez@…:

I hate web browsers…

I'm not sure the web2/server.py is appropriate… I assume these values aren't correct for all servers, or you wouldn't need these headers in the first place. Certainly the allowed methods list needs to correspond to what's allowed on the resource being requested.

Sorry for the late response ... you are right - my patch is not 100% correct (but it works) ... according the http://www.w3.org/TR/cors/#resource-preflight-requests the good solution is:

• if there is a Access-Control-Request-Method header
• and the request is OPTIONS
• then the request is PREFLIGHT request (without authentication) and needs special response (headers from my patch) with 200 code

[macosforgebot]

@wsanchez originally submitted this as comment:24:⁠ticket:468

• Status changed from new to closed
• Resolution set to Not to be fixed

---

Expiring old bugs with unknown state and impact.