DX Application Performance Management

Expand all | Collapse all

COMMAND CENTER API + Access-Control-Allow-Origin - How to fix?

Jump to Best Answer
  • 1.  COMMAND CENTER API + Access-Control-Allow-Origin - How to fix?

    Posted 05-03-2016 11:47 AM

    I'm developing  one app which connects in the APM Command Center to get informations by the APM Command Center API. The problem is:

     

     

    If i have instaled my App in one server different from the server which the AP Command Center is installed, i get the following error:

     

     

    XMLHttpRequest cannot load http://******:8082/apm/acc/agent. Response to preflight request doesn't pass access control check: The 'Access-Control-Allow-Origin' header has a value 'http://******:8082' that is not equal to the supplied origin. Origin 'http://yyyyyy:8088' is therefore not allowed access.

     

     

    So the ACC API is not allowing requests from other origins! How can i fix that?

     

     

    Obs:

     

     

    The http://xxxxxxx is the IP of the APM Command Center Configuratio Server

     

     

    The http://yyyyyyy is the IP of my web appliction who is calling the Command Center API



  • 2.  Re: COMMAND CENTER API + Access-Control-Allow-Origin - How to fix?

    Posted 05-03-2016 12:13 PM

    Hi Diego,

     

     

    Thx for contacting us about this issue, we’re currently looking at your problem and should come up with an answer within the next 24 hours.

     

    I believe this comes from some cross-site scripting detection that we’ve put in place in the ACC Server, but we’ll give you a more useful answer.

     

    In the meantime, can I ask you what kind of data you’re trying to get out of ACC and to what purpose? We have this nice API, but we would really like to know what our users are using it for!

     

    Thx,

     

    Florian.



  • 3.  Re: COMMAND CENTER API + Access-Control-Allow-Origin - How to fix?

    Posted 05-03-2016 12:37 PM

    Hello,

    Thanks for reply! i'm using this app to manage my APM projects. I have a lot of customers using APM and I'm develoment one unic interface to lead with the information of each customer. So i'll register the IP of ACC and your token to each customer project.



  • 4.  Re: COMMAND CENTER API + Access-Control-Allow-Origin - How to fix?

    Posted 05-04-2016 06:09 AM

    That’s interesting, and what kind of data will you be presenting to them? If it’s fine with you, I would really like you to show me your application and talk about what you’re doing in more details.



  • 5.  Re: COMMAND CENTER API + Access-Control-Allow-Origin - How to fix?

    Posted 05-03-2016 12:26 PM

    Hi Diego,

     

    We have started looking into the problem, and it seems indeed to be a security feature of the product aimed to protect it against cross site forgery requests.

     

    This is all documented here:

    https://docops.ca.com/ca-apm/10-2/en/administrating/ca-apm-command-center/appendix/security-considerations

     

     

    To solve this issue can you:

    1.    Open the APMCommandCenterServer/config/apmccsrv.properties file.

    2.    Add the following lines:

    1. Trusted aliases that can be used as HTTP Referer

    com.ca.apm.acc.security.csrf.authorizedAliases=

    3.    Set the values of the property.

    The value is a trusted alias or aliases. It can be an array, with values separated by commas, for example: 127.0.0.1,localhost,accdemo.

    o    An asterisk/star means that cross-site request forgery protection is disabled - any alias is permitted. This is the default setting.

    o    An empty string means that no alias is trusted.

     

     

    And let me know if that works? If it does not, we’ll try more exotic things ☺

     

    Regards,

     

    Florian.



  • 6.  Re: COMMAND CENTER API + Access-Control-Allow-Origin - How to fix?

    Posted 05-03-2016 12:56 PM

    Hi Florian,

     

    This tip dosen't work :/. I have put this properties in the apmccsrv.properties:

     

    ##### ACC CROSS ORIGIN

    com.ca.apm.acc.security.csrf.authorizedAliases=<IP OF THE APP SERVER>,localhost

     

    And get the same error:

    XMLHttpRequest cannot load http://<ACC IP>:8088/apm/acc/agent. Response to preflight request doesn't pass access control check: The 'Access-Control-Allow-Origin' header has a value 'http://<ACC IP>:8088' that is not equal to the supplied origin. Origin 'http://<IP OF THE APP SERVER>:8088' is therefore not allowed access.

     

    I'll try the APP Server port to test if it'll work.



  • 7.  Re: COMMAND CENTER API + Access-Control-Allow-Origin - How to fix?

    Posted 05-03-2016 01:02 PM

    it did not work!



  • 8.  Re: COMMAND CENTER API + Access-Control-Allow-Origin - How to fix?
    Best Answer

    Posted 05-03-2016 10:29 PM

    Florian,

    Thanks for all... here is the solution:

     

    "Hi Diego,

     

    My team suggests to modify

    1. com.ca.apm.acc.security.cors.allowedOrigins=http://******:8088,http://yyyy:8088

    in ‘apmccsrv.properties’

     

    more info on it:

    By default, Ajax calls are allowed only from web apps hosted under the same scheme://host:port as the API itself (e.g. http://10.200.7.103:8088 ). If you want to integrate from websites hosted under other URLs, you need to use com.ca.apm.acc.security.cors.allowedOrigins as noted by Matt.

     

    A more drastic (but less secure) configuration is to completely disable the CORS filter using: com.ca.apm.acc.security.cors.allowUnknownOrigins=true. This sets the response of the pre-flight request to Access-Control-Allow-Origin: <referer-URL>

     

     

    FYI, the property com.ca.apm.acc.security.csrf.authorizedAliases is used for different purpose (as an anti-CSRF) but it's disabled by default due to the nature of the ACC app  which for the time-being is immune to CSRF attacks."

     

     

    Hope it helps. Please let me know whether it did or not so I can maybe raise a kb article on it. Thanks~!



  • 9.  Re: COMMAND CENTER API + Access-Control-Allow-Origin - How to fix?

    Posted 05-04-2016 06:12 AM

    Hi Diego,

     

    Glad that it worked, it seems like we should probably document that property!

     

    Thx for working with us,

     

    Florian.