Pi-Hole component CORS issue

[adyanth]

Can I understand the reason behind including credentials: true in ecec695 (corrected implementation in bbe7149)?

Since Access-Control-Allow-Credentials is not set by Pi-Hole, this fails. Also, there is no need for cookies to be included, since Pi-Hole API does not need any login/auth. Please revert this change (or I can send in a PR) so that we don't impose any such restrictions.

CC: @mcclurec

[adyanth]

Test:

[adyanth]

I see that it was part of this PR #258
It would help in that case, but break other implementations :(

[adyanth]

To people coming here running docker versions with the fix for Pi-Hole CORS (docker v2021.09 and later) and running it behind traefik, we can make use of middlewares to fix it.

    labels:
      - traefik.http.routers.pihole.middlewares=pihole-cors
      - traefik.http.middlewares.pihole-cors.headers.customresponseheaders.Access-Control-Allow-Credentials=true

[mcclurec]

@adyanth 👋 I don't get the access-control-allow-credentials on my own setup, although I'd need to dig in farther to see what's setting the header to true. I run Traefik as a reverse proxy, but haven't explicitly set the header like in your example. I'm running PiHoile v5.4 and the full response payload says it's being served by lighttpd, which I know is the PiHole server backend. Let me know if you'd like to investigate this further.

Here's a copy pasta from my own Homer dashboard making the call to a PiHole on a subdomain through Authelia and Traefik

Request

:authority: pihole.example.com # redacted
:method: GET
:path: /admin/api.php
:scheme: https
accept: */*
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cache-control: no-cache
cookie: authelia_session=xxxxxxx # redacted
origin: https://example.com # redacted
pragma: no-cache
referer: https://example.com/ # redacted
sec-ch-ua: "Google Chrome";v="93", " Not;A Brand";v="99", "Chromium";v="93"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "macOS"
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: same-site
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36

Response

access-control-allow-credentials: true
access-control-allow-origin: https://example.com # redacted
cache-control: no-store, no-cache, must-revalidate
content-length: 484
content-type: application/json
date: Mon, 27 Sep 2021 20:49:40 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: lighttpd/1.4.53
vary: Origin
x-frame-options: DENY
x-pi-hole: The Pi-hole Web interface is working!

[adyanth]

@mcclurec I'm curious as to which version of Pi Hole are you using?

[mcclurec]

v5.4