Merge pull request #11649 from futa-ikeda/feature/cors

[ENG-10688] CORS for website container

Author: cslzchen

api/base/settings/defaults.py

@@ -217,6 +217,10 @@
 # Set dynamically on app init
 ORIGINS_WHITELIST = ()
 
+# CORS settings for flask app
+FLASK_CORS_ORIGIN_WHITELIST = CORS_ORIGIN_WHITELIST
+FLASK_CORS_ALLOW_CREDENTIALS = CORS_ALLOW_CREDENTIALS
+
 MIDDLEWARE = (
     'api.base.middleware.DjangoGlobalMiddleware',
     'api.base.middleware.CeleryTaskMiddleware',

api/base/settings/local-dist.py

@@ -7,6 +7,8 @@
 ENABLE_VARNISH = False
 ENABLE_ESI = False
 CORS_ORIGIN_ALLOW_ALL = True
+FLASK_CORS_ORIGIN_WHITELIST += (osf_settings.LOCAL_ANGULAR_DOMAIN.rstrip('/'),)
+FLASK_CORS_ALLOW_CREDENTIALS = True
 
 # Uncomment to get real tracebacks while testing
 # DEBUG_PROPAGATE_EXCEPTIONS = True

poetry.lock

@@ -95,6 +95,7 @@ django-elasticsearch-metrics = {git ="https://github.com/CenterForOpenScience/dj
 djangorestframework-csv = "3.0.2"
 gevent = "24.2.1"
 packaging = "^24.0"
+flask-cors = "6.0.1"
 
 [tool.poetry.group.dev.dependencies]
 pytest = "7.4.4"

pyproject.toml

@@ -1,3 +1,5 @@
+from flask_cors import CORS as FLASK_CORS
+
 import framework
 import importlib
 import json
@@ -6,6 +8,8 @@
 from collections import OrderedDict
 
 import django
+
+from api.base.settings import FLASK_CORS_ALLOW_CREDENTIALS, FLASK_CORS_ORIGIN_WHITELIST
 from api.caching import listeners  # noqa
 from django.apps import apps
 from framework.addons.utils import render_addon_capabilities
@@ -89,6 +93,9 @@ def init_app(settings_module='website.settings', set_backends=True, routes=True,
     if app.config.get('IS_INITIALIZED', False) is True:
         return app
 
+    # Setup CORS for flask app
+    FLASK_CORS(app, supports_credentials=FLASK_CORS_ALLOW_CREDENTIALS, origins=FLASK_CORS_ORIGIN_WHITELIST)
+
     setup_django()
 
     # The settings module

website/app.py

@@ -19,6 +19,7 @@
 DOMAIN = PROTOCOL + 'localhost:5000/'
 INTERNAL_DOMAIN = DOMAIN
 API_DOMAIN = PROTOCOL + 'localhost:8000/'
+LOCAL_ANGULAR_DOMAIN = PROTOCOL + 'localhost:4200/'
 
 #WATERBUTLER_URL = 'http://localhost:7777'
 #WATERBUTLER_INTERNAL_URL = WATERBUTLER_URL