CORS support looks buggy, is applied to all Drupal responses, has no test coverage [#2822283]

\Drupal\acquia_contenthub_subscriber\EventSubscriber\ContentHubSubscriberEvent's sole purpose is to enable CORS support (and the class name should probably give that away, but it does not).

Specifically this line: $response->headers->set('Access-Control-Allow-Origin', '*');… that effectively allows any origin to request this.

I'd look into https://www.drupal.org/node/2715637.

Comments

Comment #1

26 October 2016 at 12:17

Wim Leers created an issue. See original summary.

Comment #2

Wim Leers

Ghent 🇧🇪🇪🇺

CreditAttribution: Wim Leers at Acquia commented 26 October 2016 at 12:18

Issue tags:

+Needs tests

Also, there's no test coverage for this at all. Anything that is security-sensitive should have test coverage.

Comment #3

Wim Leers

Ghent 🇧🇪🇪🇺

CreditAttribution: Wim Leers at Acquia commented 26 October 2016 at 12:20

Title:	Hardcoded CORS support looks buggy	» CORS support looks buggy, is applied to all Drupal responses, has no test coverage
Priority:	Normal	» Major

Worse, this is running for all responses…

Comment #4

scor CreditAttribution: scor as a volunteer commented 27 October 2016 at 19:47

Status:

Active

» Needs work

We had it baked in the module originally when we were working on the ember app using the ember server, but since we ship the ember app in the module, we no longer need CORS. We are planning to remove it. Tracking this internally in CHMS-1004.