Problem with cherrypy and "same origin policy"
stefano tisi <[email protected]> Mon, 8 Jul 2019 22:45:03 -0700 (PDT)
| Newsgroups | gmane.comp.python.cherrypy |
|---|---|
| Message-ID | <[email protected]> |
------=_Part_2482_1431685343.1562651103948
Content-Type: multipart/alternative;
boundary="----=_Part_2483_1131772316.1562651103948"
------=_Part_2483_1131772316.1562651103948
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Hi people, do you want to make the world a better place? Greener, smarter=
=20
and so on? So just help me with this problem and for sure this will be=20
reality !!!
Stop joking, I ask you to help me because it is two days I have this=20
problem and I can't find a solution and the entire project is unusable.
I have a web site on "localhost" using some API provided by cherrypy on=20
localhost:8085 (I must use API to do this project). The "simplified version=
=20
of api.py is this (also in attachements):
import random=20
import string=20
import cherrypy=20
import mysql.connector
import json
class FindMeAPI(object):
exposed =3D True
@cherrypy.tools.accept(media=3D'text/plain')
def GET (self, *uri, **params):
return "stupid string 1"
=20
def POST (self, *uri, **params):=20
return "stupid string 2"
=20
def DELETE (self, *uri, **params):
return "stupid string 3"
=20
=20
def CORS():
cherrypy.response.headers["Allow"] =3D "POST, GET, DELETE, OPTIONS"
cherrypy.response.headers["Access-Control-Request-Headers"] =3D=20
"x-requested-with" =20
cherrypy.response.headers["Access-Control-Allow-Origin"] =3D "*"
cherrypy.response.headers["Access-Control-Allow-Headers"] =3D "Origin,=
=20
X-Requested-With, Content-Type, Accept"
cherrypy.response.headers["Content-Type"] =3D "application/json"
print cherrypy.response.headers
=20
if __name__ =3D=3D '__main__':
conf =3D {
'/': {
'request.dispatch': cherrypy.dispatch.MethodDispatcher(),
'tools.sessions.on': True,
'tools.response_headers.on': True,
'tools.CORS.on': True,
'tools.response_headers.headers': [('Content-Type',=20
'text/plain')],
}
}
=20
cherrypy.server.socket_host =3D '0.0.0.0'
cherrypy.tools.CORS =3D cherrypy.Tool('before_handler', CORS)
cherrypy.config.update({'server.socket_port': 8085})
cherrypy.quickstart(FindMeAPI(), '/findme', conf)
=20
I use postman to check and.... Yeee! It works!
But, then I use AJAX in my html page to call the API (now to make it easy I=
=20
removed the content of API and I put just some strings as returned value)=
=20
with this javascript code:
function deleteTravel(){
var xhttp_deleteTravel =3D new XMLHttpRequest();
xhttp_deleteTravel.onreadystatechange =3D function() {
if (this.readyState =3D=3D 4 && this.status =3D=3D 200) {
console.log("it works!");
}
}
xhttp_deleteTravel.open("DELETE",=20
"http://localhost:8085/findme", true);
xhttp_deleteTravel.send();
}
And what I get is this error message in console:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the=
=20
remote resource at http://localhost:8085/findme?id=3D10. (Reason: CORS head=
er=20
=E2=80=98Access-Control-Allow-Origin=E2=80=99 missing).[Learn More]
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the=
=20
remote resource at http://localhost:8085/findme?id=3D10. (Reason: CORS=20
request did not succeed).[Learn More]
Any idea to help me?
It works with GET method but not with DELETE. Even if they basically do the=
=20
same stuff. It seems that cherrypy is ignoring the line where I authorize=
=20
the use of "DELETE" .
Please, help me. Maybe the world wouldn't be smarter, but for me this task=
=20
is very important.
--=20
You received this message because you are subscribed to the Google Groups "=
cherrypy-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to cherrypy-users+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
To view this discussion on the web visit https://groups.google.com/d/msgid/=
cherrypy-users/f9bb4bf9-6038-49a5-bc11-3bec3479b8c0%40googlegroups.com.
------=_Part_2483_1131772316.1562651103948
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div>Hi people, do you want to make the world a better pla=
ce? Greener, smarter and so on? So just help me with this problem and for s=
ure this will be reality !!!</div><div><br></div><div>Stop joking, I ask yo=
u to help me because it is two days I have this problem and I can't fin=
d a solution and the entire project is unusable.</div><div><br></div><div>I=
have a web site on "localhost" using some API provided by cherry=
py on localhost:8085 (I must use API to do this project). The "simplif=
ied version of api.py is this (also in attachements):</div><div><br></div><=
div>import random <br>import string <br>import cherrypy <br>import mysql.co=
nnector<br>import json<br><br>class FindMeAPI(object):<br>=C2=A0=C2=A0=C2=
=A0 exposed =3D True<br>=C2=A0=C2=A0=C2=A0 @cherrypy.tools.accept(media=3D&=
#39;text/plain')<br>=C2=A0=C2=A0=C2=A0 def GET (self, *uri, **params):<=
br>=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 return "stupid string 1"=
<br>=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 <br>=C2=A0=C2=A0=C2=A0 def POST (=
self, *uri, **params): <br>=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 return &qu=
ot;stupid string 2"<br>=C2=A0=C2=A0=C2=A0 <br>=C2=A0=C2=A0=C2=A0 def D=
ELETE (self, *uri, **params):<br>=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 retu=
rn "stupid string 3"<br>=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 <br=
>=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 <br>def CORS():<br>=C2=A0=C2=A0=C2=
=A0 cherrypy.response.headers["Allow"] =3D "POST, GET, DELET=
E, OPTIONS"<br>=C2=A0=C2=A0=C2=A0 cherrypy.response.headers["Acce=
ss-Control-Request-Headers"] =3D "x-requested-with"=C2=A0=C2=
=A0=C2=A0 <br>=C2=A0=C2=A0=C2=A0 cherrypy.response.headers["Access-Con=
trol-Allow-Origin"] =3D "*"<br>=C2=A0=C2=A0=C2=A0 cherrypy.r=
esponse.headers["Access-Control-Allow-Headers"] =3D "Origin,=
X-Requested-With, Content-Type, Accept"<br>=C2=A0=C2=A0=C2=A0 cherryp=
y.response.headers["Content-Type"] =3D "application/json&quo=
t;<br>=C2=A0=C2=A0=C2=A0 print cherrypy.response.headers<br>=C2=A0=C2=A0=C2=
=A0 <br>if __name__ =3D=3D '__main__':<br>=C2=A0=C2=A0=C2=A0 conf =
=3D {<br>=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 '/': {<br>=C2=A0=C2=
=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 'request.dispatch':=
cherrypy.dispatch.MethodDispatcher(),<br>=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=
=C2=A0 =C2=A0=C2=A0=C2=A0 'tools.sessions.on': True,<br>=C2=A0=C2=
=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 'tools.response_headers=
.on': True,<br>=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=
'tools.CORS.on': True,<br>=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =
=C2=A0=C2=A0=C2=A0 'tools.response_headers.headers': [('Content=
-Type', 'text/plain')],<br>=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=
=A0 =C2=A0=C2=A0=C2=A0 }<br>=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 }<br>=C2=
=A0=C2=A0=C2=A0 <br>=C2=A0=C2=A0=C2=A0 cherrypy.server.socket_host =3D '=
;0.0.0.0'<br>=C2=A0=C2=A0=C2=A0 cherrypy.tools.CORS =3D cherrypy.Tool(&=
#39;before_handler', CORS)<br>=C2=A0=C2=A0=C2=A0 cherrypy.config.update=
({'server.socket_port': 8085})<br>=C2=A0=C2=A0=C2=A0 cherrypy.quick=
start(FindMeAPI(), '/findme', conf)<br>=C2=A0=C2=A0=C2=A0 <br></div=
><div><br></div><div><br></div><div><br></div><div>I use postman to check a=
nd....=C2=A0 Yeee! It works!<br></div><div>But, then I use AJAX in my html =
page to call the API (now to make it easy I removed the content of API and =
I put just some strings as returned value) with this javascript code:</div>=
<div><br></div><div><br></div><div><br></div><div><br></div><div>=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 function deleteTravel(){<br>=C2=A0=C2=A0=
=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 var xhttp_deleteTravel =3D new=
XMLHttpRequest();<br>=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=
=A0 xhttp_deleteTravel.onreadystatechange =3D function() {<br>=C2=A0=C2=A0=
=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 if (this.re=
adyState =3D=3D 4 && this.status =3D=3D 200) {<br>=C2=A0=C2=A0=C2=
=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=
=C2=A0 console.log("it works!");<br>=C2=A0=C2=A0=C2=A0 =C2=A0=C2=
=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 }<br>=C2=A0=C2=A0=C2=A0 =C2=
=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 }<br>=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=
=A0 =C2=A0=C2=A0=C2=A0 xhttp_deleteTravel.open("DELETE", "ht=
tp://localhost:8085/findme", true);<br>=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=
=C2=A0 =C2=A0=C2=A0=C2=A0 xhttp_deleteTravel.send();<br>=C2=A0=C2=A0=C2=A0 =
=C2=A0=C2=A0=C2=A0 }<br></div><div><br></div><div><br></div><div><br></div>=
<div><br></div><div>And what I get is this error message in console:</div><=
div><br></div><div>Cross-Origin Request Blocked: The Same Origin Policy dis=
allows reading the remote resource at http://localhost:8085/findme?id=3D10.=
(Reason: CORS header =E2=80=98Access-Control-Allow-Origin=E2=80=99 missing=
).[Learn More]<br>Cross-Origin Request Blocked: The Same Origin Policy disa=
llows reading the remote resource at http://localhost:8085/findme?id=3D10. =
(Reason: CORS request did not succeed).[Learn More]</div><div><br></div><di=
v><br></div><div><br></div><div>Any idea to help me?</div><div><br></div><d=
iv>It works with GET method but not with DELETE. Even if they basically do =
the same stuff. It seems that cherrypy is ignoring the line where I authori=
ze the use of "DELETE" .</div><div><br></div><div>Please, help me=
. Maybe the world wouldn't be smarter, but for me this task is very imp=
ortant.<br></div><div><br></div></div>
<p></p>
-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;cherrypy-users" group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:cherrypy-users+unsubscribe-/[email protected]">cher=
rypy-users+unsubscribe-/[email protected]</a>.<br />
To view this discussion on the web visit <a href=3D"https://groups.google.c=
om/d/msgid/cherrypy-users/f9bb4bf9-6038-49a5-bc11-3bec3479b8c0%40googlegrou=
ps.com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/d/=
msgid/cherrypy-users/f9bb4bf9-6038-49a5-bc11-3bec3479b8c0%40googlegroups.co=
m</a>.<br />
------=_Part_2483_1131772316.1562651103948--
------=_Part_2482_1431685343.1562651103948
Content-Type: text/x-python; charset=US-ASCII; name=api2.py
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename=api2.py
X-Attachment-Id: dc76dd4e-7a04-40e4-81e2-429e1c7efd4e
Content-ID: <dc76dd4e-7a04-40e4-81e2-429e1c7efd4e>
import random
import string
import cherrypy
import mysql.connector
import json
class FindMeAPI(object):
exposed = True
@cherrypy.tools.accept(media='text/plain')
def GET (self, *uri, **params):
return "stupid string 1"
def POST (self, *uri, **params):
return "stupid string 2"
def DELETE (self, *uri, **params):
return "stupid string 3"
def CORS():
cherrypy.response.headers["Allow"] = "POST, GET, DELETE, OPTIONS"
cherrypy.response.headers["Access-Control-Request-Headers"] = "x-requested-with"
cherrypy.response.headers["Access-Control-Allow-Origin"] = "*"
cherrypy.response.headers["Access-Control-Allow-Headers"] = "Origin, X-Requested-With, Content-Type, Accept"
cherrypy.response.headers["Content-Type"] = "application/json"
print cherrypy.response.headers
if __name__ == '__main__':
conf = {
'/': {
'request.dispatch': cherrypy.dispatch.MethodDispatcher(),
'tools.sessions.on': True,
'tools.response_headers.on': True,
'tools.CORS.on': True,
'tools.response_headers.headers': [('Content-Type', 'text/plain')],
}
}
cherrypy.server.socket_host = '0.0.0.0'
cherrypy.tools.CORS = cherrypy.Tool('before_handler', CORS)
cherrypy.config.update({'server.socket_port': 8085})
cherrypy.quickstart(FindMeAPI(), '/findme', conf)
------=_Part_2482_1431685343.1562651103948--