From e56a039fcbfa3be02a60ce6c8239fc34140328bf Mon Sep 17 00:00:00 2001 From: Tigran Mkrtchyan Date: Tue, 18 Aug 2026 11:22:55 +0200 Subject: [PATCH 1/2] frontend: add CORS header Motivation: dcache's REST API can be integrated into various web application such as data catalogs. For seamless integration dCache should provide the allowedOrigins header. Modification: move CrossOriginResourceSharingHandler class from webdav into util/jetty directory. Update frontend.xml to include CrossOriginResourceSharingHandler in the jetty handler list. Introduce property `frontend.allowed.client.origins` to control allowed origins. Result: frontend can be called from third-party javascript applications if allowed. Acked-by: Target: master Require-book: no Require-notes: yes --- .../resources/org/dcache/frontend/frontend.xml | 3 +++ .../main/resources/org/dcache/webdav/webdav.xml | 2 +- .../jetty}/CrossOriginResourceSharingHandler.java | 2 +- skel/share/defaults/frontend.properties | 14 ++++++++++++++ 4 files changed, 19 insertions(+), 2 deletions(-) rename modules/{dcache-webdav/src/main/java/org/dcache/webdav => dcache/src/main/java/org/dcache/util/jetty}/CrossOriginResourceSharingHandler.java (99%) diff --git a/modules/dcache-frontend/src/main/resources/org/dcache/frontend/frontend.xml b/modules/dcache-frontend/src/main/resources/org/dcache/frontend/frontend.xml index e4ef27a5931..99a2fc1c04d 100644 --- a/modules/dcache-frontend/src/main/resources/org/dcache/frontend/frontend.xml +++ b/modules/dcache-frontend/src/main/resources/org/dcache/frontend/frontend.xml @@ -409,6 +409,9 @@ + + + Provide access to dcache-view diff --git a/modules/dcache-webdav/src/main/resources/org/dcache/webdav/webdav.xml b/modules/dcache-webdav/src/main/resources/org/dcache/webdav/webdav.xml index 48f1a4c2b52..8fb0f54cbdb 100644 --- a/modules/dcache-webdav/src/main/resources/org/dcache/webdav/webdav.xml +++ b/modules/dcache-webdav/src/main/resources/org/dcache/webdav/webdav.xml @@ -316,7 +316,7 @@ - + diff --git a/modules/dcache-webdav/src/main/java/org/dcache/webdav/CrossOriginResourceSharingHandler.java b/modules/dcache/src/main/java/org/dcache/util/jetty/CrossOriginResourceSharingHandler.java similarity index 99% rename from modules/dcache-webdav/src/main/java/org/dcache/webdav/CrossOriginResourceSharingHandler.java rename to modules/dcache/src/main/java/org/dcache/util/jetty/CrossOriginResourceSharingHandler.java index d8831e1b4cd..45938ab2a4b 100644 --- a/modules/dcache-webdav/src/main/java/org/dcache/webdav/CrossOriginResourceSharingHandler.java +++ b/modules/dcache/src/main/java/org/dcache/util/jetty/CrossOriginResourceSharingHandler.java @@ -1,4 +1,4 @@ -package org.dcache.webdav; +package org.dcache.util.jetty; import static com.google.common.base.Preconditions.checkArgument; diff --git a/skel/share/defaults/frontend.properties b/skel/share/defaults/frontend.properties index 8e0c756fdd6..7852e2fc52e 100644 --- a/skel/share/defaults/frontend.properties +++ b/skel/share/defaults/frontend.properties @@ -759,6 +759,20 @@ frontend.limits.blocked-clients.idle-time = 10 (one-of?MILLISECONDS|SECONDS|MINUTES|HOURS|DAYS)\ frontend.limits.blocked-clients.idle-time.units = SECONDS +# ---- Cross-Origin Resource Sharing (CORS) +# +# The websites that may provide JavaScript to +# a web browser that then accesses this door. +# Values are a comma-separated list of website +# URLs without any path; e.g., +# https://example.org, http://example.org:8080 +# +# If empty then no website is authorised. +# Non-JavaScript clients are unaffected by +# this property. +# +frontend.allowed.client.origins = + (deprecated)frontend.wellknown!wlcg-tape-rest-api.path = Use dcache.wellknown!wlcg-tape-rest-api.path instead (obsolete)frontend.dcache-view.endpoints.webapi = Use frontend.static!dcache-view.endpoints.webapi instead From a3e8b4917e0da302ea987661df0f2e72bfefbf9c Mon Sep 17 00:00:00 2001 From: dCache Bot Date: Thu, 10 Sep 2026 10:41:25 +0000 Subject: [PATCH 2/2] [skip-ci] docs: document frontend CORS property Assisted-by: reasoning/desy-assistant --- .../src/main/markdown/config-frontend.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/docs/TheBook/src/main/markdown/config-frontend.md b/docs/TheBook/src/main/markdown/config-frontend.md index fef13cfa59b..9bb01f1c961 100644 --- a/docs/TheBook/src/main/markdown/config-frontend.md +++ b/docs/TheBook/src/main/markdown/config-frontend.md @@ -41,6 +41,25 @@ The service can be run out-of-the-box without changing default property values. There are a few properties affecting the admin/monitoring components which should, however, be noted. +## Allowing third-party web applications to call the REST API + +By default, the REST API can only be called from JavaScript served by the +same origin as the dCache Frontend. This prevents unauthorised websites from +making requests on behalf of a logged-in user. If you run a web application +the browser loads from a different origin — for example a data catalogue or a +dashboard — you can allow that origin to call the REST API by listing it in +`frontend.allowed.client.origins`. + +```ini +[frontendDomain/frontend] +frontend.allowed.client.origins = https://catalogue.example.org, https://dashboard.example.org +``` + +Values are a comma-separated list of website origins (scheme, host and port +if non-default) *without* any path. If the list is empty, no website is +authorised. Non-JavaScript clients (for example `curl`) are unaffected by +this property. + ## Properties controlling monitoring data collection The number of threads which are available to collect data from