Question

CORS policy

  • 22 December 2022
  • 1 reply
  • 127 views
D
Badge

My company has a Centreon service (network equipment monitoring for the entire company) hosted locally. The monitoring information is visible on a WEB page.
I would like to retrieve some information (state of certain network equipment/WEB pages) to display it to all staff.
This is where an API comes in, initially I made a "curl" request to retrieve an identification token in order to contact the API.
In a second step, I made a request with the token to retrieve all the monitoring information in JSON format.
So far, everything is working.
Now I would like to "automate" this process by making it accessible on a WEB page.
I am using javascript code (see below) to query my API but it is not working. The code seems good but it is blocking on the server side.

 

 

I was given a suggestion to add a line in the file "/opt/rh/httpd24/root/etc/httpd/conf.d/10-centreon.conf", but it made no difference :

    Header  set X-Frame-Options: "ALLOW-FROM http://your.url.com/"

I also looked into the meaning of CORS, but I can't seem to resolve this issue. Here is a list of the various things I've seen on the internet, can you tell me which ones I should keep.

Could the problem be that I am hosting my WEB site with a Visual Studio Code extension rather than a real server?

I await your proposals, hoping that you will be able to help me.

1 reply

ponchoh
Rank
Userlevel 4
Badge +13

👋

 

@DorianLQ sorry we didn’t finish here:

 

You can use an api client to get something that works

https://docs.centreon.com/docs/api/rest-api-v2/#import-the-openapi-definition

https://learning.postman.com/docs/getting-started/introduction/

ie.

var xhr = new XMLHttpRequest();
xhr.withCredentials = true;

xhr.addEventListener("readystatechange", function() {
  if(this.readyState === 4) {
    console.log(this.responseText);
  }
});

xhr.open("GET", "http://domain.example/centreon/api/latest/monitoring/hosts?show_service=true");
xhr.setRequestHeader("Accept", "application/json");
xhr.setRequestHeader("X-AUTH-TOKEN", "tBEbauoPK2sDfcooJSO9QrG9Qpk9gBnMr+wZFO1iQGSclLGqb/3cpioSQd+F8GYp");

xhr.send();

and you have to play around with your Headers. Do highly recommend to keep everything behind HTTPS 🔒

You might be missing:

Header set Access-Control-Allow-Credentials true

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials

🤞

 

Reply


Terms & ConditionsCookie settings