{"action":"created","issue":{"url":"https://api.github.com/repos/couchbase/sync_gateway/issues/762","labels_url":"https://api.github.com/repos/couchbase/sync_gateway/issues/762/labels{/name}","comments_url":"https://api.github.com/repos/couchbase/sync_gateway/issues/762/comments","events_url":"https://api.github.com/repos/couchbase/sync_gateway/issues/762/events","html_url":"https://github.com/couchbase/sync_gateway/issues/762","id":65291757,"number":762,"title":"configurable CORS on login resources","user":{"login":"jchris","id":253,"avatar_url":"https://avatars.githubusercontent.com/u/253?v=3","gravatar_id":"","url":"https://api.github.com/users/jchris","html_url":"https://github.com/jchris","followers_url":"https://api.github.com/users/jchris/followers","following_url":"https://api.github.com/users/jchris/following{/other_user}","gists_url":"https://api.github.com/users/jchris/gists{/gist_id}","starred_url":"https://api.github.com/users/jchris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jchris/subscriptions","organizations_url":"https://api.github.com/users/jchris/orgs","repos_url":"https://api.github.com/users/jchris/repos","events_url":"https://api.github.com/users/jchris/events{/privacy}","received_events_url":"https://api.github.com/users/jchris/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/couchbase/sync_gateway/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":{"login":"jchris","id":253,"avatar_url":"https://avatars.githubusercontent.com/u/253?v=3","gravatar_id":"","url":"https://api.github.com/users/jchris","html_url":"https://github.com/jchris","followers_url":"https://api.github.com/users/jchris/followers","following_url":"https://api.github.com/users/jchris/following{/other_user}","gists_url":"https://api.github.com/users/jchris/gists{/gist_id}","starred_url":"https://api.github.com/users/jchris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jchris/subscriptions","organizations_url":"https://api.github.com/users/jchris/orgs","repos_url":"https://api.github.com/users/jchris/repos","events_url":"https://api.github.com/users/jchris/events{/privacy}","received_events_url":"https://api.github.com/users/jchris/received_events","type":"User","site_admin":false},"milestone":null,"comments":6,"created_at":"2015-03-30T20:09:52Z","updated_at":"2015-04-06T17:54:31Z","closed_at":null,"body":"The first implementation of CORS support was conservative about enabling login via CORS.\r\n\r\nHowever most apps will want to enable login from CORS hosts, simply because that is where the UI is located. So we need to make an option to enable CORS for logins.\r\n\r\nI think this could be another field in the CORS config object, named `sessionOrigin` which would have an array of string origins as it's value.\r\n\r\nFor sugar, we could also have the option of `true` in cases where there will be many origins and all should have login access.\r\n\r\nThis config would then be consulted in places like this: https://github.com/couchbase/sync_gateway/blob/36ac90f6a60e7137658791158ca252c85071ce2b/src/github.com/couchbase/sync_gateway/rest/facebook.go#L29\r\n\r\nI'm labeling this a bug because CORS is not useful for anything besides toy apps without this. Tag @jamiltz b/c he's about to run into this.\r\n\r\nN.B. It would be easy to convince me that we should just remove the protection from the session endpoints, and if CORS is turned on at all, it's turned on for session stuff too."},"comment":{"url":"https://api.github.com/repos/couchbase/sync_gateway/issues/comments/90174660","html_url":"https://github.com/couchbase/sync_gateway/issues/762#issuecomment-90174660","issue_url":"https://api.github.com/repos/couchbase/sync_gateway/issues/762","id":90174660,"user":{"login":"jchris","id":253,"avatar_url":"https://avatars.githubusercontent.com/u/253?v=3","gravatar_id":"","url":"https://api.github.com/users/jchris","html_url":"https://github.com/jchris","followers_url":"https://api.github.com/users/jchris/followers","following_url":"https://api.github.com/users/jchris/following{/other_user}","gists_url":"https://api.github.com/users/jchris/gists{/gist_id}","starred_url":"https://api.github.com/users/jchris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jchris/subscriptions","organizations_url":"https://api.github.com/users/jchris/orgs","repos_url":"https://api.github.com/users/jchris/repos","events_url":"https://api.github.com/users/jchris/events{/privacy}","received_events_url":"https://api.github.com/users/jchris/received_events","type":"User","site_admin":false},"created_at":"2015-04-06T17:54:31Z","updated_at":"2015-04-06T17:54:31Z","body":"I'm in the code implementing now, and that last point makes me think we might want different policy for different endpoints. This is one of those things that will probably get controlled by a proxy in a deployed app, but SG should ship with something workable for getting started purposes."}}