API Calls from Webapp

[patsche]

Hello everybody,

I'm currently making API calls from my VueJS web application. The problem is that I am blocked because of the CORS Poilcy. The Proxmox web server on which the GUI is running must send me a parameter. Does one of you know where the config files are? Or can this be added by Proxmox?

The Access-Control-Allow-Origin header is missing. Since I am sending the API call from a different domain than the one on which the Proxmox server is running, the requests are blocked. Therefore this would have to be set as a wildcard in the web server config.

The GUI / API web server also does not accept the OPTIONS request.

Thank you in advance

 

[flapili]

same issue ...

 

[s4wet]

same issue here

 

[fabian]

you can just put an NGINX (or another reverse proxy) in front of PVE and add the needed headers there..

 

[ltcptgeneral]

Finally figured this out myself, a possible configuration with nginx includes these lines:

```
add_header 'Access-Control-Allow-Origin' '$http_origin' always;
add_header 'Access-Control-Allow-Credentials' 'true' always;
```
Keep in mind that this will allow any requests from any origin.

 

[carl.chang]

I made this to work with PVE 7.3-3 (without using a reverse proxy) by modding two files that are involved in handling web requests.

• /usr/share/perl5/PVE/APIServer/AnyEvent.pm
  

  my $known_methods = {
      GET => 1,
      POST => 1,
      PUT => 1,
      DELETE => 1,
      OPTIONS => 1, # added
  };

  
  

  $resp->header('Server' => "pve-api-daemon/3.0");
  $resp->header('Access-Control-Allow-Origin' => "*"); # added
  $resp->header('Access-Control-Allow-Methods' => "*"); # added
  $resp->header('Access-Control-Allow-Headers' => "*"); # added

• /usr/share/perl5/PVE/HTTPServer.pm
  

  # explicitly allow some calls without auth
  if (($rel_uri eq '/access/domains' && $method eq 'GET') ||
      ($rel_uri eq '/access/ticket' && ($method eq 'GET' || $method eq 'POST')) ||
      ($rel_uri eq '/access/openid/login' &&  $method eq 'POST') ||
      ($rel_uri eq '/access/openid/auth-url' &&  $method eq 'POST') || # changed
      ($method eq 'OPTIONS')) { # added
      $require_auth = 0;
  }

  
  

  my $resp = {
  status => HTTP_NOT_IMPLEMENTED,
  message => "Method '$method $rel_uri' not implemented",
  };
  
  if ($method eq 'OPTIONS') { # added
      $resp = { status => HTTP_OK }; # added
  } # added
  
  my ($handler, $info);

The changes / hacks are just to get it to work in my lab and it is by no means secure or anything (and I'm no expert on web servers or perl).
The request to support setting CORS headers is tracked here.

 

[stellar2703]

I made this to work with PVE 7.3-3 (without using a reverse proxy) by modding two files that are involved in handling web requests.

• /usr/share/perl5/PVE/APIServer/AnyEvent.pm
  

  my $known_methods = {
      GET => 1,
      POST => 1,
      PUT => 1,
      DELETE => 1,
      OPTIONS => 1, # added
  };

  
  

  $resp->header('Server' => "pve-api-daemon/3.0");
  $resp->header('Access-Control-Allow-Origin' => "*"); # added
  $resp->header('Access-Control-Allow-Methods' => "*"); # added
  $resp->header('Access-Control-Allow-Headers' => "*"); # added

• /usr/share/perl5/PVE/HTTPServer.pm
  

  # explicitly allow some calls without auth
  if (($rel_uri eq '/access/domains' && $method eq 'GET') ||
      ($rel_uri eq '/access/ticket' && ($method eq 'GET' || $method eq 'POST')) ||
      ($rel_uri eq '/access/openid/login' &&  $method eq 'POST') ||
      ($rel_uri eq '/access/openid/auth-url' &&  $method eq 'POST') || # changed
      ($method eq 'OPTIONS')) { # added
      $require_auth = 0;
  }

  
  

  my $resp = {
  status => HTTP_NOT_IMPLEMENTED,
  message => "Method '$method $rel_uri' not implemented",
  };
  
  if ($method eq 'OPTIONS') { # added
      $resp = { status => HTTP_OK }; # added
  } # added
  
  my ($handler, $info);

The changes / hacks are just to get it to work in my lab and it is by no means secure or anything (and I'm no expert on web servers or perl).
The request to support setting CORS headers is tracked here.

I did the same but i was still blocked for some reason by CORS policy. I am using react for my project and i did api call via react. Does anybody have any idea of how to proceed