Enable CORS on useful endpoints

[LukasReschke]

Regarding benweet/stackedit#122 (comment) we should create a list of APIs where we should enable CORS to allow third-party devs integrate with ownCloud. Feel free to add more:

• OCS Share API (no private data)
• WebDAV
• CalDAV
• CardDAV

[LukasReschke]

@jancborchardt @PVince81 @jfearn

[PVince81]

Include OCS Share API
Exclude OCS Privatedata API until we have OAuth2 with more granular API permissions: an app should only be allowed to read/write its own data, not access other apps data

[jancborchardt]

I added CalDAV and CardDAV (although they are not part of core).

cc @skddc @michielbdejong for remoteStorage.

[PVince81]

Ideally oauth2 should be implemented first: #10400

[michielbdejong]

So IIUC, the code for CORS was added to the middleware last May, but it was never actually activated on the OCS Share API?

That's what I understand from the discussion above, and also, I did a simple test against the API of the demo instance:

curl -I https://test:[email protected]/ocs/v1.php/apps/files_sharing/api/v1/shares

and got back no CORS headers.

(side note: there were actually some cookie headers on there which should be removed if/when switching to CORS)

[DeepDiver1975]

So IIUC, the code for CORS was added to the middleware last May, but it was never actually activated on the OCS Share API?

ocs share api is not using app framework controllers - we cannot apply the cors middleware - yet

[PVince81]

CORS was implemented with domain whitelisting here: #28457

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.