CORS

Cross-Origin Resource Sharing (CORS) is a browser mechanism that controls which web origins may call an HTTP API. A browser blocks a request from a page whose origin differs from the server's in host, port, or protocol unless the server says otherwise, so a browser-based client hosted separately from Gravitino needs the CORS filter enabled.

The UI does not need CORS. It calls the server through its own proxy, so the browser only ever talks to the UI's origin.

The filter is off by default and applies only to browsers. Requests from engines and other server-side clients are unaffected either way.

Quick start

The example lets a browser application served from {app_origin}, such as https://console.example.com, call the Gravitino server.

1. Enable the filter for one origin. Add the properties to my-values.yaml.

   my-values.yaml

   gravitino:
     additionalConfigItems:
       gravitino.server.webserver.enableCorsFilter: "true"
       gravitino.server.webserver.allowedOrigins: "{app_origin}"
       gravitino.server.webserver.allowedHeaders: "X-Requested-With,Content-Type,Accept,Origin,Authorization"

2. Apply the values. Rerun the helm upgrade --install command from Install.

3. Check the response headers. Send a request that names the origin, as a browser would.

   Request with an Origin header

   curl -sS -o /dev/null -D - "https://{gravitino_host}/api/metalakes" \
     -H "Origin: {app_origin}" \
     -H "Accept: application/vnd.gravitino.v1+json" \
     -H "Authorization: Bearer $TOKEN"

   The response headers include Access-Control-Allow-Origin with {app_origin}. A request naming any other origin gets no such header, and the browser blocks the response.

Authorization is added to allowedHeaders because the default list omits it, and a browser sending a bearer token names that header in its preflight request.

Configuration

The Gravitino server, the Iceberg REST service, and the Lance REST service each have their own CORS filter, configured with the same property names under different prefixes. Use gravitino.server.webserver. for the Gravitino server, gravitino.iceberg-rest. for the Iceberg REST service, and gravitino.lance-rest. for the Lance REST service, and set each one only for the service that needs it.

Property	Description	Default
enableCorsFilter	Enables the CORS filter	false
allowedOrigins	Comma-separated origins allowed to access the resources, or * for all	*
allowedTimingOrigins	Comma-separated origins allowed to time the resources. Empty means none	(empty)
allowedMethods	Comma-separated HTTP methods allowed when accessing the resources	GET,POST,HEAD,DELETE,PUT
allowedHeaders	Comma-separated request headers allowed, or a single * to accept any header	X-Requested-With,Content-Type,Accept,Origin
exposedHeaders	Comma-separated response headers made readable to the client. Empty means none	(empty)
preflightMaxAgeInSecs	How long a client may cache a preflight response	1800
allowCredentials	Whether requests carrying credentials are allowed	true
chainPreflight	Passes preflight requests to the target resource as an OPTIONS request instead of answering them in the filter	true

No chart value exists for any of these properties, so they go under gravitino.additionalConfigItems as quoted strings; see Set other server properties. Once applied, they appear on the Settings tab under Configure in the UI.

Origins and credentials

List the origins your clients actually use. With the defaults, allowedOrigins at * and allowCredentials at true, the filter answers every request with that request's own origin and allows credentials, so any website a signed-in user visits can make authenticated calls to the server from their browser.

warning

Do not enable the filter with allowedOrigins left at *. Every website then gets credentialed access to the server through its users' browsers.

Related

• Set other server properties
• HTTPS