Added CorsFilter to enable secure cross site scripting

[controller.git] / opendaylight / northbound / topology / src / main / resources / WEB-INF / web.xml

diff --git a/opendaylight/northbound/topology/src/main/resources/WEB-INF/web.xml b/opendaylight/northbound/topology/src/main/resources/WEB-INF/web.xml
index e40c5fbfbf63804c159f93505c7a6b9153af390d..bc818c8c6d46e1a3d86d46f162a9bd628e51e8a5 100644 (file)
--- a/opendaylight/northbound/topology/src/main/resources/WEB-INF/web.xml
+++ b/opendaylight/northbound/topology/src/main/resources/WEB-INF/web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="ISO-8859-1"?>
 <web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
-       version="3.0">
+        xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
+        version="3.0">
   <servlet>
     <servlet-name>JAXRSTopology</servlet-name>
     <servlet-class>com.sun.jersey.spi.container.servlet.ServletContainer</servlet-class>
@@ -17,34 +17,73 @@
     <url-pattern>/*</url-pattern>
   </servlet-mapping>
 
-       <security-constraint>
-               <web-resource-collection>
-                       <web-resource-name>NB api</web-resource-name>
-                       <url-pattern>/*</url-pattern>
-               </web-resource-collection>
-               <auth-constraint>
-                       <role-name>System-Admin</role-name>
-                       <role-name>Network-Admin</role-name>
-                       <role-name>Network-Operator</role-name>
-                       <role-name>Container-User</role-name>
-               </auth-constraint>
-       </security-constraint>
+        <filter>
+          <filter-name>CorsFilter</filter-name>
+          <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
+          <init-param>
+            <param-name>cors.allowed.origins</param-name>
+            <param-value>*</param-value>
+          </init-param>
+          <init-param>
+            <param-name>cors.allowed.methods</param-name>
+            <param-value>GET,POST,HEAD,OPTIONS,PUT</param-value>
+          </init-param>
+          <init-param>
+            <param-name>cors.allowed.headers</param-name>
+            <param-value>Content-Type,X-Requested-With,accept,authorization, origin,Origin,Access-Control-Request-Method,Access-Control-Request-Headers</param-value>
+          </init-param>
+          <init-param>
+            <param-name>cors.exposed.headers</param-name>
+            <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
+          </init-param>
+          <init-param>
+            <param-name>cors.support.credentials</param-name>
+            <param-value>true</param-value>
+          </init-param>
+          <init-param>
+            <param-name>cors.preflight.maxage</param-name>
+            <param-value>10</param-value>
+          </init-param>
+        </filter>
+        <filter-mapping>
+          <filter-name>CorsFilter</filter-name>
+          <url-pattern>/*</url-pattern>
+        </filter-mapping>
 
-       <security-role>
-               <role-name>System-Admin</role-name>
-       </security-role>
-       <security-role>
-               <role-name>Network-Admin</role-name>
-       </security-role>
-       <security-role>
-               <role-name>Network-Operator</role-name>
-       </security-role>
-       <security-role>
-               <role-name>Container-User</role-name>
-       </security-role>
+        <security-constraint>
+          <web-resource-collection>
+            <web-resource-name>NB api</web-resource-name>
+            <url-pattern>/*</url-pattern>
+            <http-method>POST</http-method>
+            <http-method>GET</http-method>
+            <http-method>PUT</http-method>
+            <http-method>PATCH</http-method>
+            <http-method>DELETE</http-method>
+            <http-method>HEAD</http-method>
+          </web-resource-collection>
+          <auth-constraint>
+            <role-name>System-Admin</role-name>
+            <role-name>Network-Admin</role-name>
+            <role-name>Network-Operator</role-name>
+            <role-name>Container-User</role-name>
+          </auth-constraint>
+        </security-constraint>
 
-       <login-config>
-               <auth-method>BASIC</auth-method>
-               <realm-name>opendaylight</realm-name>
-       </login-config>
+        <security-role>
+                <role-name>System-Admin</role-name>
+        </security-role>
+        <security-role>
+                <role-name>Network-Admin</role-name>
+        </security-role>
+        <security-role>
+                <role-name>Network-Operator</role-name>
+        </security-role>
+        <security-role>
+                <role-name>Container-User</role-name>
+        </security-role>
+
+        <login-config>
+                <auth-method>BASIC</auth-method>
+                <realm-name>opendaylight</realm-name>
+        </login-config>
 </web-app>