perfSONAR User Q&A and Other Discussion

[Michael Johnson <>]

Hi Grant,

I'm glad to hear you're using the Toolkit API in your project! It was 
designed to accommodate use cases like yours, although I don't know how many 
people actually use it that way.

The CORS headers are part of the Apache configuration. Specifically, this 
file:

/etc/httpd/conf.d/apache-toolkit_web_gui.conf

You could change the values for these options, or comment them out if you 
want it wide open.

Under
<Directory "/usr/lib/perfsonar/web-ng/root">


Header set X-Frame-Options "DENY"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"
Header set Content-Security-Policy

This site has some good information about the secure headers options you have 
available:
https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#tab=Headers

Thanks,
Michael

On Tue, Dec 12, 2017 at 12:38:14AM +0000, 

 wrote:
> I am unfamiliar with cgi scripts and was wondering if someone could help point
> me to where in the toolkit source I need to edit to allow CORS.
>
> I am trying to access /toolkit/services/host.cgi?method=<etc> like an API for
> some PS metrics we are exposing through an internal app.
>
> - Grant

--
Michael Johnson
GlobalNOC Software Engineering
Indiana University

812-856-2771

Attachment: smime.p7s
Description: S/MIME cryptographic signature