Enabled OCS Share API CORS

[Silbad]

Hello,
Can you add the possibility to enabled CORS pour OCS Share API (https://docs.nextcloud.com/server/latest/developer_manual/client_apis/OCS/ocs-share-api.html) ? Webdav don't support sharing links...
Thanks ^^

[pbek]

Thank you for your suggestion.
First someone would need to find out what CORS headers are supposed to be set and that headers shouldn't be on by default. So there would need to be more configuration options on the admin page.

[vialcollet]

Hi
This would be really nice to have this feature.
I am creating an obisdian plugin to share notes but I am blocked by this CORS issue.

[aleixq]

I am looking too at how this could be solved...

Adding the annotation @CORS createShare method in ShareAPIController.php of files_sharing app , and adding the route in appinfo/routes.php:

[                                       
'name' => 'ShareAPI#preflighted_cors',
'url' => '/api/v1/shares',
'verb' => 'OPTIONS',
],

allows the sharing api to be used from an external url to create a share (not a surprise as it's said in https://docs.nextcloud.com/server/22/developer_manual/digging_deeper/rest_apis.html#rest-apis ).

Altering the core files_sharing app isn't the way to go, but I cannot find any event to listen and react, to adapt the response to OPTIONS and POST method request to /api/v1/shares files_share route. This would help when using the api in a dedicated app ...

Something like https://symfony.com/doc/current/reference/events.html#kernel-response would be great But using symfony events is discouraged

I'll keep looking.

[aleixq]

I end up extending the files_sharing shareapi controller in a new app https://gitlab.com/communia/files_sharing_webapppassword to add a check origin applied to the original response. Maybe this could be added to webapppassword app or remain as separated app.

Also, maybe this could be proposed in nextcloud/server repo (as was asked in nextcloud/server#3131) :
Add a middleware as @CORS is doing, or modifying the existing @CORS behavior to allow in https://github.com/nextcloud/server/blob/master/lib/private/AppFramework/Middleware/Security/CORSMiddleware.php#L116 to use a similar logic as I am using in the checkOrigin trait (https://gitlab.com/communia/files_sharing_webapppassword/-/blob/main/lib/Controller/AccessControl.php#L25 ) .

[pbek]

Nice. If you want to integrate it into webapppassword, I can review the pull request.

[pbek]

23.4.0

• A files sharing API with origin check was added
  (for #1, thank you @aleixq)

[pbek]

There now is a new release, could you please test it and report if it works for you?

[pbek]

I released it on https://apps.nextcloud.com/apps/webapppassword as well.

[aleixq]

Just adding that a draft PR is being proposed in: nextcloud/server#37896 and in related issue.

[pbek]

Great, I'll close this then.