Question about CORS

[JamieMoon]

Thank you for your hard work and great sharing, first of all.

I'm trying to adopt swagger(swagger-node-express) in my API service
as a consolidate API documentations and demo framework.

Every call of APIs in my API gateway must be referenced (i mean " be called")
in remote server(resource provider).

As a simple test, I tried to call one of them in Swagger API explorer.
("input_baseUrl" of index.html(swagger-ui)

then i got the following errors from the above trial,

(from Chrome debugger)
....
XMLHttpRequest cannot load http://ktas.konantech.com/ktas-api/1.0/lists/buzzcnt.json?api_key=pet. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://10.10.17.148:8001' is therefore not allowed access. (index):1
Unable to Load SwaggerUI (index):33
Can't read from server. It may not have the appropriate access-control-origin settings. (index):34
Uncaught Can't read from server. It may not have the appropriate access-control-origin settings. swagger.js:213
XMLHttpRequest cannot load http://ktas.konantech.com/ktas-api/1.0/lists/buzzcnt.json?api_key=pet. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://10.10.17.148:8001' is therefore not allowed access. (index):1
Unable to Load SwaggerUI (index):33
Can't read from server. It may not have the appropriate access-control-origin settings. (index):34
Uncaught Can't read from server. It may not have the appropriate access-control-origin settings. swagger.js:213
XMLHttpRequest cannot load http://ktas.konantech.com/ktas-api/1.0/lists/buzzcnt.json?api_key=pet. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://10.10.17.148:8001' is therefore not allowed access. (index):1
Unable to Load SwaggerUI (index):33
Can't read from server. It may not have the appropriate access-control-origin settings. (index):34
Uncaught Can't read from server. It may not have the appropriate access-control-origin settings. swagger.js:213
XMLHttpRequest cannot load http://ktas.konantech.com/ktas-api/1.0/lists/buzzcnt.json?api_key=pet. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://10.10.17.148:8001' is therefore not allowed access. (index):1
Unable to Load SwaggerUI (index):33
Can't read from server. It may not have the appropriate access-control-origin settings. (index):34
Uncaught Can't read from server. It may not have the appropriate access-control-origin settings.
....

My questions are

1. What exactly are the errors telling me?
   I know it's related CORS problem but i couldn't figure it out clearly.

2. If I have the similar situation in production,
   where do i have to put the codes like this ?
   (i added it in main.js (Apps\petstore\main.js) )

swagger.setHeaders = function setHeaders(res) {
res.header('Access-Control-Allow-Origin', "*");
res.header("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT");
res.header("Access-Control-Allow-Headers", "Content-Type, X-API-KEY");
res.header("Content-Type", "application/json; charset=utf-8");
};

Thanks again.

[fehguy]

Hi, take a look here:

https://github.com/wordnik/swagger-core/wiki/CORS

for point 2, you simply need to add the headers when writing the response back to the client. If you're using the swagger-node-express module, it'll add them automatically:

https://github.com/wordnik/swagger-node-express/blob/master/Common/node/swagger.js#L74

[JamieMoon]

Hi, Fehguy

Thank you for such a quick response.

What I had done before were

1. launch swagger-node-express example
   D:\Lab\Node.js\kws\swagger-node-express> node Apps\mystore\main.js

2. Check header

• D:\Lab\Node.js\kws\swagger-node-express>curl -I http://localhost:8001/docs
  HTTP/1.1 302 Moved Temporarily
  X-Powered-By: Express
  Location: /docs/
  Date: Thu, 16 Jan 2014 02:16:57 GMT
  Connection: keep-alive
• D:\Lab\Node.js\kws\swagger-node-express>curl -I http://localhost:8001/api-docs
  HTTP/1.1 200 OK
  X-Powered-By: Express
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE
  Access-Control-Allow-Headers: Content-Type, api_key
  Content-Type: application/json; charset=utf-8
  Date: Thu, 16 Jan 2014 02:17:04 GMT
  Connection: keep-alive

3. Tested my API list (Not Node.js or Swagger-Integrated) in the input box of swagger API explorer
   these API list is located in remote server and have no CORS header in their response

In '3)', as i explained what i have done before, wiki/CORS and you're telling me that
i have to add the CORS header in their(remote server APIs) response header, right?

Thank you for your patience.

[fehguy]

That is correct. The CORS support has to be on the remote server, not the server providing the swagger-ui.