JSONP requests to service/reasonBreakdown.json fails

[temi]

Some endpoints on logger like service/reasonBreakdown.json return with response header Content-Type set to application/json. This happens even for JSONP requests. Browsers are smart to change to the correct Content-Type, application/javascript. However, for security reasons, server can disable auto content-type conversion by setting X-Content-Type-Options header to nosniff. Such requests are rejected by browser. At present, collectory makes the JSONP request to show statistics. This could fail and show no stats. There are a few ways to fix this issue -

1. Configure the server to not send X-Content-Type-Options header.
2. Making sure appropriate content-type is sent for JSONP requests.
3. Enable CORS and remove JSONP requests from applications.

[ansell]

Removing X-Content-Type-Options: nosniff is only a temporary workaround, not a fix. Either Option 2 or Option 3 should be implemented before closing this issue.

[nickdos]

Collections-test is not showing usage stats when pointing to logger-test. I can see the request for a JSONP callback is not being wrapped in the JS method, as expected - its returning normal JSON.

Need to check if the JSONP is being done at app or Nginx level.

EDIT: app previously used the jsonp:0.2 plugin but not in newer Grails 3 version. Therefore need to implement this as a filter/interceptor.

[nickdos]

@Rita-C I think can be done easily with a Grails interceptor. Here's an example with an old-style Filter:

https://github.com/AtlasOfLivingAustralia/dashboard/blob/master/grails-app/conf/au/org/ala/dashboard/JSONPFilters.groovy

[Rita-C]

Collections-test is not showing usage stats when pointing to logger-test. I can see the request for a JSONP callback is not being wrapped in the JS method, as expected - its returning normal JSON.

Collectory updated, refer to AtlasOfLivingAustralia/collectory-plugin#184

Enabled CORS in logger-service

[nickdos]

Code all good.

[nickdos]

Looks good in test, tried 6 different endpoints and all showed expected headers - see screenshot: