Solve CNAME Javascript interactions w/ the API

[ericholscher]

Description

Currently we don't really support any kind of writing via the API from CNAME'd websites. This is mainly because of the cross domain requirements inside the browser. We've done some basic work w/ CORS to look into supporting this, but there are some security implications we need to think through before we turn on any kind of real access.

Proposed Solution

We now have Domain objects that are associated with each project. This means that when we get a request from a specific domain, we can map against the Domain object, and return the proper CORS headers for their domains. This should allow CNAME's to be able to have proper CORS requests against our API.

Implementation

We will build middleware that intercepts OPTIONS and GET requests to custom Domains, then does a lookup on the Domain object, and gives proper access. We will likely need to do some kind of mapping from the Domain coming in to verify that the requested URL's belong to the project associated with the domain.

We will also limit this functionality to a whitelist of API calls that we expect from documentation pages. The main thing we need to protect against is full API access for custom Domains against the RTD API. Currently I believe we only need to whitelist /api/v2/search/ and /api/v2/footer/.

Testing

When this work is done:

• API Search should work on CNAME's -- we will verify with a CNAME that the API-based RTD search works properly
• Footer rendering works properly with authed user information
• Confirm that http://docs.citusdata.com/ search works as an example use case.

References

• Integrate version compare API info into footer_html endpoint #1499

Sponsorship

This work is being sponsored by Citus Data

[begriffs]

Is it feasible to override the Access-Control-Allow-Origin response header for specific routes? I can see how in general you'd like to protect API endpoints against abuse but perhaps certain ones are safe for access from other domains.

For instance the search endpoint. Not having access to the search API from Javascript degrades the search results on our docs page when accessed via CNAME. Could you allow access to https://readthedocs.org/api/v2/search/?

/cc @agjohnson

[agjohnson]

The underlying issue was solved. What did we do to resolve this? Is this still a valid issue?

[stsewd]

We (actually Eric p:) solved this in #2341. Please re-open if I'm wrong and/or something else needs to be done.