)]}'
{"doc/source/index.rst":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"5960bccd5af070fc7b3a8a125eb38343c5100cc0","unresolved":false,"context_lines":[{"line_number":15,"context_line":"   :maxdepth: 1"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"   specs/juno/*"},{"line_number":18,"context_line":"   specs/kilo/*"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"oslo-specs Repository Information"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baa201ad_25be5a00","line":18,"updated":"2014-09-29 15:31:14.000000000","message":"This needs a whole section not just add to the juno section\n\nsuch as: https://review.openstack.org/#/c/124776/","commit_id":"050aff47b7be3a05b86df55e06b10399794bf419"},{"author":{"_account_id":12071,"name":"Richard Jones","email":"r1chardj0n3s@gmail.com","username":"richard"},"change_message_id":"fd5d50d772b7741eede457ed27b84b02f30ef4ea","unresolved":false,"context_lines":[{"line_number":15,"context_line":"   :maxdepth: 1"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"   specs/juno/*"},{"line_number":18,"context_line":"   specs/kilo/*"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"oslo-specs Repository Information"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baa201ad_0e86cab9","line":18,"in_reply_to":"baa201ad_25be5a00","updated":"2014-09-30 01:15:08.000000000","message":"Done","commit_id":"050aff47b7be3a05b86df55e06b10399794bf419"}],"specs/kilo/cors-middware.rst":[{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"71e1e0304da0da49968c8d089dcaea6992d7b21b","unresolved":false,"context_lines":[{"line_number":53,"context_line":"`keystonemiddleware.auth_token` which is already included in OpenStack APIs."},{"line_number":54,"context_line":"This was rejected as that middleware has a clearly defined purpose and CORS"},{"line_number":55,"context_line":"falls well outside that purpose."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Security Impact"},{"line_number":59,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"da9df570_715a8f51","line":56,"updated":"2014-09-24 15:33:07.000000000","message":"Another option is to change the way we recommend deploying APIs so they all fall under the same domain. Has that been explored?","commit_id":"7dbd89248b4a1d586c5b36374ebc26125801cb05"},{"author":{"_account_id":12071,"name":"Richard Jones","email":"r1chardj0n3s@gmail.com","username":"richard"},"change_message_id":"0289671e56e19b744e9c7d522c73bef36a43ef44","unresolved":false,"context_lines":[{"line_number":53,"context_line":"`keystonemiddleware.auth_token` which is already included in OpenStack APIs."},{"line_number":54,"context_line":"This was rejected as that middleware has a clearly defined purpose and CORS"},{"line_number":55,"context_line":"falls well outside that purpose."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Security Impact"},{"line_number":59,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"baa201ad_936cbe38","line":56,"in_reply_to":"da9df570_715a8f51","updated":"2014-09-29 03:08:40.000000000","message":"Unfortunately the origin is not just the domain, it\u0027s (protocol, domain, port). Having a single origin point of contact for APIs is actually how I\u0027m \"solving\" this issue without needing the CORS middleware in the horizon-replacement I\u0027m working on. Such a single origin API front-end might be interesting for other applications, we\u0027ll see. Still too early.","commit_id":"7dbd89248b4a1d586c5b36374ebc26125801cb05"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"71e1e0304da0da49968c8d089dcaea6992d7b21b","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"It is already be recommended that APIs exposed to the Internet be `served"},{"line_number":70,"context_line":"over HTTPS"},{"line_number":71,"context_line":"\u003chttp://www.rackspace.com/blog/enabling-ssl-for-the-openstack-api/\u003e`_."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"The documentation must include an explicit warning against using the wildcard"},{"line_number":74,"context_line":"`*` for the ACAO header."}],"source_content_type":"text/x-rst","patch_set":4,"id":"da9df570_7121afb3","line":71,"updated":"2014-09-24 15:33:07.000000000","message":"Do we have a similar reference in our deployer docs?","commit_id":"7dbd89248b4a1d586c5b36374ebc26125801cb05"},{"author":{"_account_id":12071,"name":"Richard Jones","email":"r1chardj0n3s@gmail.com","username":"richard"},"change_message_id":"0289671e56e19b744e9c7d522c73bef36a43ef44","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"It is already be recommended that APIs exposed to the Internet be `served"},{"line_number":70,"context_line":"over HTTPS"},{"line_number":71,"context_line":"\u003chttp://www.rackspace.com/blog/enabling-ssl-for-the-openstack-api/\u003e`_."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"The documentation must include an explicit warning against using the wildcard"},{"line_number":74,"context_line":"`*` for the ACAO header."}],"source_content_type":"text/x-rst","patch_set":4,"id":"baa201ad_53b6d68b","line":71,"in_reply_to":"da9df570_7121afb3","updated":"2014-09-29 03:08:40.000000000","message":"Done","commit_id":"7dbd89248b4a1d586c5b36374ebc26125801cb05"},{"author":{"_account_id":9717,"name":"Michael Krotscheck","email":"krotscheck@gmail.com","username":"krotscheck"},"change_message_id":"aac66bd676418426577c9e9223fa085dd934ef2b","unresolved":false,"context_lines":[{"line_number":102,"context_line":"  allow_credentials \u003d false"},{"line_number":103,"context_line":"  hijack_options \u003d true"},{"line_number":104,"context_line":"  max_age \u003d 3600"},{"line_number":105,"context_line":"  expose_headers \u003d etag, x-timestamp, x-trans-id, vary"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"The middleware will only be activated if the browser supplies an Origin"},{"line_number":108,"context_line":"header. The default configuration is to respond with an ACAO header of"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baa201ad_484a6e81","line":105,"updated":"2014-09-30 21:30:52.000000000","message":"I\u0027m not a fan of binding the middleware to oslo.config. Properly built middleware should be as self-contained as possible, so that anyone who wants to use it can do so without being forced to use other libraries. A better approach would be constructor parameters, and allow each application to choose how to source those parameters on their own.\n\nFurthermore, I feel that items such as headers, permitted methods, and credentials are implementation specific. storyboard, for instance, includes the X-Page-Size header on which the webclient depends. By allowing the header to be set in a config file, you give a deployer the ability to just break everything if they don\u0027t know that there are functionally required headers.\n\nLastly, if no configuration is provided, what are the defaults? Are they sane?","commit_id":"dcdee09d69ff81a1a16fb1a55da821aad704be1a"},{"author":{"_account_id":12071,"name":"Richard Jones","email":"r1chardj0n3s@gmail.com","username":"richard"},"change_message_id":"8b99df7c450025933e5e7b5ab9fae3656c5c8742","unresolved":false,"context_lines":[{"line_number":102,"context_line":"  allow_credentials \u003d false"},{"line_number":103,"context_line":"  hijack_options \u003d true"},{"line_number":104,"context_line":"  max_age \u003d 3600"},{"line_number":105,"context_line":"  expose_headers \u003d etag, x-timestamp, x-trans-id, vary"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"The middleware will only be activated if the browser supplies an Origin"},{"line_number":108,"context_line":"header. The default configuration is to respond with an ACAO header of"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baa201ad_1bf42ef1","line":105,"in_reply_to":"baa201ad_484a6e81","updated":"2014-09-30 21:46:07.000000000","message":"The integration of the CORS middleware into the OpenStack API servers is performed by the deployer, not the application author. For the record, no, I don\u0027t think this is an ideal situation.\n\nIn particular, the allow_origins setting could never be known by the application author.\n\nYes, the other settings are generally application-specific, but again the configuration is done by the deployer, not application author, so documentation will have to suffice here.\n\nI agree, the default settings should be included here, and I\u0027ll add that.","commit_id":"dcdee09d69ff81a1a16fb1a55da821aad704be1a"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"c27eeaae45ba4e3e02dd8df0e84ba75901679b5e","unresolved":false,"context_lines":[{"line_number":53,"context_line":"`keystonemiddleware.auth_token` which is already included in OpenStack APIs."},{"line_number":54,"context_line":"This was rejected as that middleware has a clearly defined purpose and CORS"},{"line_number":55,"context_line":"falls well outside that purpose."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Security Impact"},{"line_number":59,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"baa201ad_b99f9802","line":56,"updated":"2014-10-13 13:53:43.000000000","message":"Would it make sense to provide something like this as a stand-alone library, rather than including it in oslo.middleware? Or is there something about the middleware that ties it to our API implementation?","commit_id":"aceb4f7905219e38a7492976fe2a7e3fe5f9cbca"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"efe1c067589b237b5f8d8e6c5bcb5dfa3b16aa35","unresolved":false,"context_lines":[{"line_number":103,"context_line":"The bulk of this configuration will be handled by the API developers in the"},{"line_number":104,"context_line":"paste configuration file."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"    [filter:cors]"},{"line_number":107,"context_line":"    paste.filter_factory \u003d oslo.middleware.cors:CORSMiddleware.factory"},{"line_number":108,"context_line":"    ## Allowed origins. Either a single wildcard (\"*\"), or a comma delimited"},{"line_number":109,"context_line":"    ## list of origins. Origins are specified as the triple {protocol, host,"}],"source_content_type":"text/x-rst","patch_set":7,"id":"baa201ad_4385d657","line":106,"updated":"2014-10-13 16:06:44.000000000","message":"nit - prefix this section with a :: so that it renders as a code block in rst","commit_id":"aceb4f7905219e38a7492976fe2a7e3fe5f9cbca"},{"author":{"_account_id":12071,"name":"Richard Jones","email":"r1chardj0n3s@gmail.com","username":"richard"},"change_message_id":"94afd16ae0a71e4c21ce7ffe10f2b9c60ae57d00","unresolved":false,"context_lines":[{"line_number":103,"context_line":"The bulk of this configuration will be handled by the API developers in the"},{"line_number":104,"context_line":"paste configuration file."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"    [filter:cors]"},{"line_number":107,"context_line":"    paste.filter_factory \u003d oslo.middleware.cors:CORSMiddleware.factory"},{"line_number":108,"context_line":"    ## Allowed origins. Either a single wildcard (\"*\"), or a comma delimited"},{"line_number":109,"context_line":"    ## list of origins. Origins are specified as the triple {protocol, host,"}],"source_content_type":"text/x-rst","patch_set":7,"id":"baa201ad_8b5a6c28","line":106,"in_reply_to":"baa201ad_4385d657","updated":"2014-10-13 21:29:47.000000000","message":"Done","commit_id":"aceb4f7905219e38a7492976fe2a7e3fe5f9cbca"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"c27eeaae45ba4e3e02dd8df0e84ba75901679b5e","unresolved":false,"context_lines":[{"line_number":104,"context_line":"paste configuration file."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"    [filter:cors]"},{"line_number":107,"context_line":"    paste.filter_factory \u003d oslo.middleware.cors:CORSMiddleware.factory"},{"line_number":108,"context_line":"    ## Allowed origins. Either a single wildcard (\"*\"), or a comma delimited"},{"line_number":109,"context_line":"    ## list of origins. Origins are specified as the triple {protocol, host,"},{"line_number":110,"context_line":"    ## port}. Origins don\u0027t support partial matches, nor wildcard apart from"}],"source_content_type":"text/x-rst","patch_set":7,"id":"baa201ad_59a5cc45","line":107,"updated":"2014-10-13 13:53:43.000000000","message":"We\u0027ve been trying to remove redundancy from the middleware class names by removing the \"Middleware\". We also want the classes exposed at the level of oslo.middleware. I think that makes this something more like:\n\n  paste.filter_factory \u003d oslo.middleware.CORS.factory","commit_id":"aceb4f7905219e38a7492976fe2a7e3fe5f9cbca"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"efe1c067589b237b5f8d8e6c5bcb5dfa3b16aa35","unresolved":false,"context_lines":[{"line_number":104,"context_line":"paste configuration file."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"    [filter:cors]"},{"line_number":107,"context_line":"    paste.filter_factory \u003d oslo.middleware.cors:CORSMiddleware.factory"},{"line_number":108,"context_line":"    ## Allowed origins. Either a single wildcard (\"*\"), or a comma delimited"},{"line_number":109,"context_line":"    ## list of origins. Origins are specified as the triple {protocol, host,"},{"line_number":110,"context_line":"    ## port}. Origins don\u0027t support partial matches, nor wildcard apart from"}],"source_content_type":"text/x-rst","patch_set":7,"id":"baa201ad_035d8e15","line":107,"in_reply_to":"baa201ad_59a5cc45","updated":"2014-10-13 16:06:44.000000000","message":"++\n\nas a side note, this section is very much implementation-specific, and i don\u0027t think it belongs in a specification document at all. if we agree on the big picture, a specification should be good to go. including these details here just slows the spec process down without adding value.","commit_id":"aceb4f7905219e38a7492976fe2a7e3fe5f9cbca"},{"author":{"_account_id":12071,"name":"Richard Jones","email":"r1chardj0n3s@gmail.com","username":"richard"},"change_message_id":"94afd16ae0a71e4c21ce7ffe10f2b9c60ae57d00","unresolved":false,"context_lines":[{"line_number":104,"context_line":"paste configuration file."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"    [filter:cors]"},{"line_number":107,"context_line":"    paste.filter_factory \u003d oslo.middleware.cors:CORSMiddleware.factory"},{"line_number":108,"context_line":"    ## Allowed origins. Either a single wildcard (\"*\"), or a comma delimited"},{"line_number":109,"context_line":"    ## list of origins. Origins are specified as the triple {protocol, host,"},{"line_number":110,"context_line":"    ## port}. Origins don\u0027t support partial matches, nor wildcard apart from"}],"source_content_type":"text/x-rst","patch_set":7,"id":"baa201ad_903e17d9","line":107,"in_reply_to":"baa201ad_59a5cc45","updated":"2014-10-13 21:29:47.000000000","message":"This was written against the older pattern, and the code has been updated but I didn\u0027t keep this in sync, sorry.\n\nThis being my first spec, I wasn\u0027t sure how much detail to include. I\u0027ll trim it down.","commit_id":"aceb4f7905219e38a7492976fe2a7e3fe5f9cbca"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"efe1c067589b237b5f8d8e6c5bcb5dfa3b16aa35","unresolved":false,"context_lines":[{"line_number":139,"context_line":"    ## here."},{"line_number":140,"context_line":"    expose_headers \u003d etag, x-timestamp, x-trans-id, vary"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"The middleware will only be activated if the browser supplies an Origin"},{"line_number":143,"context_line":"header. The default configuration is to respond with an ACAO header of"},{"line_number":144,"context_line":"\"null\", telling compliant browsers that CORS is not allowed."},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"baa201ad_43ecf629","line":142,"updated":"2014-10-13 16:06:44.000000000","message":"nit - ``Origin``","commit_id":"aceb4f7905219e38a7492976fe2a7e3fe5f9cbca"},{"author":{"_account_id":12071,"name":"Richard Jones","email":"r1chardj0n3s@gmail.com","username":"richard"},"change_message_id":"94afd16ae0a71e4c21ce7ffe10f2b9c60ae57d00","unresolved":false,"context_lines":[{"line_number":139,"context_line":"    ## here."},{"line_number":140,"context_line":"    expose_headers \u003d etag, x-timestamp, x-trans-id, vary"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"The middleware will only be activated if the browser supplies an Origin"},{"line_number":143,"context_line":"header. The default configuration is to respond with an ACAO header of"},{"line_number":144,"context_line":"\"null\", telling compliant browsers that CORS is not allowed."},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"baa201ad_1053073a","line":142,"in_reply_to":"baa201ad_43ecf629","updated":"2014-10-13 21:29:47.000000000","message":"Done","commit_id":"aceb4f7905219e38a7492976fe2a7e3fe5f9cbca"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"efe1c067589b237b5f8d8e6c5bcb5dfa3b16aa35","unresolved":false,"context_lines":[{"line_number":184,"context_line":"  beginning at 15:19"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"* `OpenStack APIs should support CORS to be usable from Javascript`__ bug"},{"line_number":187,"context_line":"  filed against oslo.middleware "},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"* Abandoned `implementation by Koert van der Veer`__"},{"line_number":190,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"baa201ad_c390e698","line":187,"updated":"2014-10-13 16:06:44.000000000","message":"nit - trailing whitespace","commit_id":"aceb4f7905219e38a7492976fe2a7e3fe5f9cbca"},{"author":{"_account_id":12071,"name":"Richard Jones","email":"r1chardj0n3s@gmail.com","username":"richard"},"change_message_id":"94afd16ae0a71e4c21ce7ffe10f2b9c60ae57d00","unresolved":false,"context_lines":[{"line_number":184,"context_line":"  beginning at 15:19"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"* `OpenStack APIs should support CORS to be usable from Javascript`__ bug"},{"line_number":187,"context_line":"  filed against oslo.middleware "},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"* Abandoned `implementation by Koert van der Veer`__"},{"line_number":190,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"baa201ad_3031eb0b","line":187,"in_reply_to":"baa201ad_c390e698","updated":"2014-10-13 21:29:47.000000000","message":"Done","commit_id":"aceb4f7905219e38a7492976fe2a7e3fe5f9cbca"},{"author":{"_account_id":6537,"name":"gordon chung","email":"gord@live.ca","username":"chungg"},"change_message_id":"6f5231dde5e845e05a2a6bc652c5c9e2d800070a","unresolved":false,"context_lines":[{"line_number":66,"context_line":"this feature that browsers will be able to access OpenStack APIs directly"},{"line_number":67,"context_line":"(assuming a CORS configuration that allows them)."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"It is already be recommended that APIs exposed to the Internet be `served"},{"line_number":70,"context_line":"over HTTPS \u003chttp://docs.openstack.org/security-guide/content/ssl-proxies-and-http-services.html\u003e`_."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"baa201ad_c3909bef","line":69,"updated":"2014-10-15 16:23:31.000000000","message":"(nit) s/already be recommended/already recommended/","commit_id":"0846e7584453d6214262b488e184ee571ed4fee3"}]}