I’m attempting to set up an HTTP server in NiFi to accept uploads and process them on-demand. This gets tricky because I want to submit the files using an existing web application that will not be served from NiFi, which leads to trouble with XSS (Cross-Site Scripting) and setting up CORS (Cross Origin Resource Sharing [1]).
The trouble starts with just trying to PUT or POST a simple file. The error in Firefox reads:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource (Reason: CORS header 'Access-Control-Allow-Origin' missing).
You can serve up the Javascript that actually performs the upload from NiFi and side-step XSS, but you may still run into trouble with CORS. You’ll have trouble even if NiFi and your other web server live on the same host (using different ports, of course), as they’re considered different hosts for the purposes of XSS prevention.
To make this work, you’ll need to enable specific headers in the HandleHttpResponse processor. Neither the need to set some headers, nor the headers that need to be set, are documented by NiFi at this time (so far as I can tell).
- Open the configuration of the HandleHttpResponse processor
- Add the following headers and values as properties and values, but see below for notes regarding the values
Access-Control-Allow-Origin: * Access-Control-Allow-Methods: PUT, POST, GET, OPTIONS Access-Control-Allow-Headers: Accept, Accept-Encoding, Accept-Language, Connection, Content-Length, Content-Type, DNT, Host, Referer, User-Agent, Origin, X-Forwarded-For
You may want to review the value for Access-Control-Allow-Origin, as the wildcard may allow access to unexpected hosts. If your server is public-facing (why would you do that with NiFi?) then you certainly don’t want a wildcard here. The wildcard makes configuration much simpler if NiFi is strictly interior-facing, though.
The specific values to set for Access-Control-Allow-Methods depend on what you’re doing. You’ll probably need OPTIONS for most cases. I’m serving up static files so I need GET, and I’m receiving uploads that may or may not be chunked, so I need POST and PUT.
The actual headers needed for Access-Control-Allow-Headers is a bit variable. A wildcard is not an acceptable value here, so you’ll have to list every header you need separately — and there are a bunch of possible headers. See [3] for an explanation and a fairly comprehensive list of possible headers. Our list contains a small subset that covers our basic test cases; your mileage may vary.
You may also want to set up a RouteOnAttribute processor to ignore OPTIONS requests (${http.method:equals('OPTIONS')}), otherwise you might see a bunch of zero-byte files in your flow.
References:
[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
[3] http://stackoverflow.com/questions/13146892/cors-access-control-allow-headers-wildcard-being-ignored