Rh-che: Need to test new CORS configuration in 6.15 that will be applied by default in 6.16 release

[ibuziuk]

from @mkuznyetsov email:

We have some news regarding to CORS filter configuration changes in 6.16.

In Che 6.16 we plan to upgrade Tomcat from 8.5.23 to 8.5.35. This however will require us to update our CORS filter configuration for Che WS Master and WS agent, since it would not allow our current CORS configuration which is deemed to be unsecure.
More information about original Tomcat issue is at https://bz.apache.org/bugzilla/show_bug.cgi?id=62343

This is the configuration that will be applied for Che CORS filters in Che 6.16:

• WS Master - CORS Filter disabled
• WS Agent - CORS Filter enabled, allowing requests with credentials, providing Domain of WS Master as an allowed origin

Before we will merge these changes in 6.16, there will be added options to test this configuraion in Che 6.15 (https://github.com/eclipse/che/pull/12046)
We encourage you to try this configuration in 6.15 version to see if it works for your Che installation.

Here are the steps to enable this configuration, using following environment variables for Che deployment:

1) CHE_CORS_ENABLED=false - disable CORS on WS Master.
2) CHE_WSAGENT_CORS_ALLOWED__ORIGINS=<wsmaster-domain> - set the default allowed origin of WS Agent CORS pointing to Domain of WS Master (replace <wsmaster-domain> with actual WS master domain )

If you discover an regression related to this configuration (for example, certain cross origin requests are not working in your Che installation).
Please reach out to us describing the issues you have, so we may address them before Che 6.16 release.

[ibuziuk]

blocked by https://github.com/redhat-developer/rh-che/issues/1110

[garagatyi]

LOL see https://github.com/redhat-developer/rh-che/issues/1117
You were 2 minutes ahead!

[ibuziuk]

PR for adding env vars which allow to disable cors - https://github.com/redhat-developer/rh-che/pull/1133/files

[ibuziuk]

@rhopp @Katka92 @ScrewTSW CORS are currently disabled on prod-preview

Will you be able to test openshift.io, che.openshift.io and e2e registration flow before we would disable CORS on prod ? Also please test functionality of adding custom registry via UD

[Katka92]

@ibuziuk Sorry I probably didn't get something - you have disabled it on prod-preview and want us to test production?

[ibuziuk]

@Katka92 CORS were disabled on prod-preview. Once you +1 and confirm that everything works fine on prod-preview I will promote this config to prod. The scenarios for testing are openshift.io, che.openshift.io (both che 6 & che 7) and e2e registration flow + adding custom registry via UD functionality

[Katka92]

Current progress with testing:

• [x] workspace creation and start-up with openshift.io
• [x] creating and starting of project via che dashboard (vert.x, nodejs)
• [x] running project (vert.x, nodejs)
• [x] e2e registration flow on prod-preview (required provisioning from service-del team)
• [x] factory with vert.x project
• [x] custom stack creation
• [x] test che 7 with theia
  
  
  
  • workspace with theia is started successfully
  
  
  • selected example project is not imported
  
  
• [ ] add custom registry via UD (not working for me but probably not related) https://github.com/redhat-developer/rh-che/issues/1139

[ibuziuk]

@Katka92 thanks for the tests. HK issue [1] for disabling CORS on prod:

[1] https://gitlab.cee.redhat.com/dtsd/housekeeping/issues/2480

[ibuziuk]

@Katka92 CORS are now disabled on prod. Could you please verify if all works as expected ?

[Katka92]

@ibuziuk I've tried on production

• e2e registration flow
• workspace creation and start via openshift.io
• workspace creation and start via che dashboard
• run vert.x example project
• factory
• custom stack creation and usage

and all seems to work fine here.

[ibuziuk]

@Katka92 thank you for verification.
@skabashnyuk all seems to work fine with the following values applied on prod:

CHE_CORS_ENABLED = false
CHE_WSAGENT_CORS_ALLOWED__ORIGINS = https://che.openshift.io

Closing