add http://{127.0.0.1,localhost}[:5001] as allowed default CORS referer

[MichaelMure]

Fix #1883 and #1839 for me.

License: MIT
Signed-off-by: Michael Muré mure.michael@gmail.com

[rht]

And ipfs/ipfs-webui#82

[ghost]

I like!

Maybe we should do the same for the gateway? And also add :8080 to the API headers, to make the API-via-Gateway work?

[jbenet]

@MichaelMure yeah-- there is something very odd going on. this is supposed to happen naturally: https://github.com/ipfs/go-ipfs/blob/27eece3e81f4e946db4294702c9ac39bd86ccce6/core/corehttp/commands.go#L70

[jbenet]

im not sure adding this to config is the right way-- i think we should fix the bug in the code.

[ghost]

Oh @jbenet is right, we should fix the code

[MichaelMure]

Soooo, what happen is that the default origins are stored as string with a placeholder for the port (for instance http://127.0.0.1:<port>). The patchCORSVars is here to replace <port> with the correct port. This function use a sample net.Listener to find the right port. There is a race condition somewhere, and the port selected end up being 8080 instead of 5001.

[rht]

patchCORSVars is called for each http api and gateway that there shouldn't be a race condition?

I tried fmt.Println-ing the port after this line, I got both 5001 and 8080.

[jbenet]

ah interesting. that's likely the problem!

[jbenet]

this is a priority fix as this is screwing up uses of the API. anybody have a bugfix?

@whyrusleeping if we find a bugfix in the next couple of days can we fit this into 0.3.10 along with the other api fix?

cc @dignifiedquire and @diasdavid as they're probably interested

[daviddias]

SGTM! :)

[dignifiedquire]

Would love to have a fix for this yes, can't comment on race conditions in go code I'm afraid ;)

[rht]

I noticed the defaultLocalhostOrigins slice was mutated in https://github.com/ipfs/go-ipfs/blob/792da9d87587e28d65b98a28fa4cc2d20388ccca/core/corehttp/commands.go#L95 regardless of the rwmutex protection from 4555085.

A possible fix: https://github.com/rht/go-ipfs/tree/fix/corsconfig (rht@e7dee98). I checked the c.AllowedOrigins(), with this fix they show 5001 for 8080 for each api and gateway. Previously it depends on which one mutates the slice first (the race condition described by @MichaelMure).
This means the rwmutex thing is probably unnecessary.

[parkan]

+1 for this, webui is broken for me