https://jira.opendaylight.org This file is an XML representation of an issue en-us 8.20.10 820010 22-06-2022 https://jira.opendaylight.org/browse/AAA-213 aaa <p>shiro-impl's WebContextSecurer currently performs two tasks: it adds the authentication layer, but it also adds CORS control headers, which defeat browsers' engine sensitivity.</p> <p>The CORS policy needs to be separate from authentication and needs to be cross-cutting. Separate the CORS filter into its own component and integrate it via OSGi HTTP Whiteboard, so that it gets applied irrespective of WebContextSecurer invocation.</p> <p>This component should be an experimental feature, which is not installed by default.</p> AAA-213

Remove CORS filter from shiro-impl

Improvement Medium Resolved Done Robert Varga Robert Varga pt Tue, 18 May 2021 11:27:40 +0000 Wed, 6 Jul 2022 22:09:06 +0000 Wed, 6 Jul 2022 11:56:57 +0000 0.16.0 General 0 1 <p>Actually, let's just remove the CORS filter and reinstanstate it if someone needs it.</p> <p>If there is an actual need for it going forward, we will need to include a proper component which can be configured. As an example, the old CORS filter did not handle PATCH requests, which brings to the light the need to interact with actual downstreams (like RESTCONF PATCH requests).</p> Duplicate AAA-197 Development Rank 0|i03y27: