API access for third partes

[matamadio]

We need to provide API access to TH db for external users. Currently, they have issues using the queries from external domains. Here is the message:

We have been trying to access following APIs inside our application, which is built in Angular (Web) & C# (REST API). Though we can access these APIs in browser without any issue, when we try to access same from our source code, we get following error:

Access to XMLHttpRequest at 'http://thinkhazard.org/en/report/115.json' from origin 'http://localhost:54055' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Issue here is, as we are trying to access it from Arrk domain, which is outside of http://thinkhazard.org, it’s getting blocked.
From our side we also tried to pass Access-Control-Allow-Origin parameter at request header, but that didn’t helped. To solve this issue, is it possible for you to change API’s CORS configuration to allow all domain, so it will not block the requests made by our application?
To begin with, if you have any test environment, then try changing configuration on same, then we will try to access it.

[arnaud-morvan]

I've created related ticket in JIRA : https://jira.camptocamp.com/browse/GSWBTH-37

I've added CORS header on API on int.thinkhazard.org see: http://int.thinkhazard.org/fr/hazardcategory/EQ/LOW.json

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET

[RobSchilderr]

Hey did anyone have a solution on https://jira.camptocamp.com/browse/GSWBTH-37? I can not access this link unfortunately.

[matamadio]

Hi Rob,

thanks for the feedback. CORS access should've been working, let me paste your message to help with solution:

I was trying to use your API by making a request through the client, and I received a CORS error. This error does not appear in Postman or when I request data through the server. However, for my use case I would like to request the data through the browser. Is there a reason why I am getting this error? I am using the "useSWR" package for ReactJS in case that makes any sense. It would be great if you could explain me the solution!

[arnaud-morvan]

Just tried with https://www.thinkhazard.org/fr/hazardcategory/FL/MED.json
Seems CORS headers are correct:

$ curl -v https://www.thinkhazard.org/fr/hazardcategory/FL/MED.json

< HTTP/1.1 200 OK
< Server: gunicorn/20.0.4
< Date: Wed, 17 Feb 2021 12:04:37 GMT
< Set-Cookie: _LOCALE_=fr; Max-Age=12096000; Path=/; expires=Wed, 07-Jul-2021 12:04:37 GMT
< Access-Control-Allow-Origin: *
< Access-Control-Allow-Methods: GET
< Content-Type: application/json
< Content-Length: 33094
< Last-Modified: Tue, 30 Jun 2020 15:57:03 GMT

Could you give the url and the error message.

[RobSchilderr]

Hi Arnaud, thanks for checking the issue. Here is the link that I used: http://thinkhazard.org/en/report/177.json

And here is a reproduction of my attempt: https://github.com/RobSchilderr/useSWRGetServer

[RobSchilderr]

Just tried with https://www.thinkhazard.org/fr/hazardcategory/FL/MED.json
Seems CORS headers are correct:

$ curl -v https://www.thinkhazard.org/fr/hazardcategory/FL/MED.json

< HTTP/1.1 200 OK
< Server: gunicorn/20.0.4
< Date: Wed, 17 Feb 2021 12:04:37 GMT
< Set-Cookie: _LOCALE_=fr; Max-Age=12096000; Path=/; expires=Wed, 07-Jul-2021 12:04:37 GMT
< Access-Control-Allow-Origin: *
< Access-Control-Allow-Methods: GET
< Content-Type: application/json
< Content-Length: 33094
< Last-Modified: Tue, 30 Jun 2020 15:57:03 GMT

Could you give the url and the error message.

This link does work indeed. :)

[arnaud-morvan]

Sorry but http://thinkhazard.org/en/report/177.json is not part of the API routes which supports cross origin requests.

The routes that support CORS are:

• /admindiv_hazardsets/{hazardtype:([A-Z]{2})}.json
• /hazardcategory/{hazard_type:([A-Z]{2})}/{hazard_level:([A-Z]{3})}.json

CORS headers are not added on other routes.

[RobSchilderr]

Sorry but http://thinkhazard.org/en/report/177.json is not part of the API routes which supports cross origin requests.

The routes that support CORS are:

• /admindiv_hazardsets/{hazardtype:([A-Z]{2})}.json
• /hazardcategory/{hazard_type:([A-Z]{2})}/{hazard_level:([A-Z]{3})}.json

CORS headers are not added on other routes.

Alright, thanks for answering :)