3

I am trying to upload an file to ovh object storage (openstack swift), but run into issues.

In Chrome I get: 

Refused to get unsafe header "Location"

I tried solving this with by adding 'Access-Control-Expose-Headers': 'Location' to the request headers. But error remains.

In Firefox I get following in the console:

OPTIONS XHR
[HTTP/1.1 200 OK 421ms]

Request Headers:
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.5
Access-Control-Request-Headers: access-control-expose-headers,tus-resumable,upload-length,upload-metadata,x-auth-token
Access-Control-Request-Method: POST
Connection: keep-alive
Host: storage.gra1.cloud.ovh.net
Origin: http://localhost:8089
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0

Response Headers:
Allow: HEAD, GET, PUT, POST, OPTIONS, DELETE
Content-Length: 0
Date: Thu, 01 Feb 2018 14:55:05 GMT
X-IPLB-Instance: 12318
X-Openstack-Request-Id: txe638462886d66db5ad3c6-005a732a49
X-Trans-Id: txe638462886d66db5ad3c6-005a732a49
access-control-allow-headers: x-auth-token, upload-metadata, upload-length, tus-resumable, access-control-expose-headers
access-control-allow-methods: HEAD, GET, PUT, POST, OPTIONS, DELETE
access-control-allow-origin: *
vary: Access-Control-Request-Headers


POST XHR 
[HTTP/1.1 204 No Content 579ms]
Request Headers
Accept: */*
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.5
Access-Control-Expose-Headers: Location
Connection: keep-alive
Content-Length: 0
Host: storage.gra1.cloud.ovh.net
Origin: http://localhost:8089
Referer: http://localhost:8089/mywebpage
Tus-Resumable: 1.0.0
Upload-Length: 4885581
Upload-Metadata: modelId RmF2b3usrGVz,name MjIyLmpwZz==,type aW1hZ2UvanBlZz==
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0
X-Auth-Token: aSecret000000001

Response Headers
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: x-trans-id, content-language, X-Container-Read, expires, X-Storage-Policy, last-modified, etag, x-timestamp, pragma, cache-control, content-type, x-openstack-request-id
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Thu, 01 Feb 2018 14:55:05 GMT
X-IPLB-Instance: 12309
X-Openstack-Request-Id: txe638462886d66db5ad3c6-005a732a49
X-Trans-Id: txe638462886d66db5ad3c6-005a732a49

I do not know whether 'No Content' means successful, or something wrong, anyway the file is not send, so probably the last.

My questions: - How to get rid of the Chrome error message - How to get the file across.

musicformellons
  • 12,283
  • 4
  • 51
  • 86
  • More information in answers and comments here: https://stackoverflow.com/questions/5822985/cross-domain-resource-sharing-get-refused-to-get-unsafe-header-etag-from-re – mplungjan Feb 01 '18 at 15:45

1 Answers1

3

Access-Control-Expose-Headers should be added to the response by the requested resource's provider (OpenStack Swift), not the client. What you need to do is to configure OpenStack Swift to add this header to its responses.

So how are you going to do it? OpenStack allows you to set/append custom values for Access-Control-Allow-Origin, Access-Control-Max-Age and Access-Control-Expose-Headers for each container. Please see this official document for details.

Example:

Let's create a container and set the custom header values we want to add to the Access-Control-Expose-Headers in the response to the requests made for the objects in this container.

curl -i -X PUT -H "X-Auth-Token: yourtoken" \
    -H "X-Container-Meta-Access-Control-Expose-Headers: Location" \
    http://192.168.56.3:8080/v1/AUTH_test/cont1

Now for every object you create in this container, you will see Location listed in Access-Control-Expose-Headers and get rid of the error message in Chrome.

You can see the rest of the CORS headers you can configure for each container, in the documentation I linked above.

McMutton
  • 905
  • 13
  • 25
  • I set the Location header conform your instructions and indeed the Chrome error is gone, but somehow it persist in the [uppy](https://uppy.io/docs/uppy/) package I use and more specifically in its [tus plugin](https://uppy.io/docs/tus/). The error is: `Error: tus: invalid or missing Location header, originated from request (response code: 204, response text: )` – musicformellons Feb 01 '18 at 18:43
  • Mmh, I replaced the tus plugin with the xhrupload plugin of uppy and now things are starting to work! – musicformellons Feb 02 '18 at 10:24
  • 1
    I am happy that it worked for you. The problem with tus seems to be that it is looking for the `Location` header in the response but OpenStack does not add that to the response by default. – McMutton Feb 02 '18 at 10:28