starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-13 13:53:31 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Enable CORS on API #662

New Issue
Closed
opened 2025-12-29 16:24:31 +01:00 by adam · 5 comments
adam commented 2025-12-29 16:24:31 +01:00
Owner
Copy Link

Originally created by @mraerino on GitHub (Jan 25, 2017).

Right now one can't use the Netbox API for frontend/js apps without setting up an api proxy, because the preflight OPTIONS request of the browser is not recognized by the API and therefore not successful.

This could be handled by a custom DjangoRestFramework permission class like here: http://stackoverflow.com/questions/30460409/how-do-i-check-for-options-request-in-django-rest-framework-3-0-serializer

Originally created by @mraerino on GitHub (Jan 25, 2017). Right now one can't use the Netbox API for frontend/js apps without setting up an api proxy, because the preflight OPTIONS request of the browser is not recognized by the API and therefore not successful. This could be handled by a custom DjangoRestFramework permission class like here: http://stackoverflow.com/questions/30460409/how-do-i-check-for-options-request-in-django-rest-framework-3-0-serializer
adam added the type: feature label 2025-12-29 16:24:31 +01:00
adam closed this issue 2025-12-29 16:24:32 +01:00
adam commented 2025-12-29 16:24:32 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Jan 25, 2017):

The current API is mostly read-only anyway. Write ability will be introduced in 2.0 (#113).

@jeremystretch commented on GitHub (Jan 25, 2017): The current API is mostly read-only anyway. Write ability will be introduced in 2.0 (#113).
adam commented 2025-12-29 16:24:32 +01:00
Author
Owner
Copy Link

@mraerino commented on GitHub (Jan 25, 2017):

This is not a matter of read or write.
I also need CORS if I want to show data from the API in some JS Application.

What do I want to do with it?
I want to make a simple site, where all the racks of a site are displayed next to each other with their devices in them.
Right now this is not possible if I don't host this site on the same origin as netbox.

@mraerino commented on GitHub (Jan 25, 2017): This is not a matter of read or write. I also need CORS if I want to show data from the API in some JS Application. **What do I want to do with it?** I want to make a simple site, where all the racks of a site are displayed next to each other with their devices in them. Right now this is not possible if I don't host this site on the same origin as netbox.
adam commented 2025-12-29 16:24:33 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Jan 25, 2017):

As I understand it (and I could easily be wrong), preflight checks aren't required for simple GET requests. Can you provide an example request that your application is sending?

@jeremystretch commented on GitHub (Jan 25, 2017): As I understand it (and I could easily be wrong), preflight checks aren't required for simple GET requests. Can you provide an example request that your application is sending?
adam commented 2025-12-29 16:24:33 +01:00
Author
Owner
Copy Link

@mraerino commented on GitHub (Jan 25, 2017):

Unfortunately Preflight requests are made for all requests that have special headers like "Authentication": https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Simple_requests
I think this is true for most cases, since people tend to enable login_required.

But even if there is no preflight, the server still needs to return Access-Control-Allow-Origin: * for all requests.

@mraerino commented on GitHub (Jan 25, 2017): Unfortunately Preflight requests are made for all requests that have special headers like "Authentication": https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Simple_requests I think this is true for most cases, since people tend to enable `login_required`. But even if there is no preflight, the server still needs to return `Access-Control-Allow-Origin: *` for all requests.
adam commented 2025-12-29 16:24:33 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Jan 26, 2017):

Noting here for reference: https://github.com/ottoyiu/django-cors-headers/

@jeremystretch commented on GitHub (Jan 26, 2017): Noting here for reference: https://github.com/ottoyiu/django-cors-headers/
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label type: feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#662
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?