We have been searching for a method to support CORS for Gateway services. We have tried open source and vendor provided reverse proxy solutions, but all have come up short in one way or the other. We have been focusing on using the SAP Web Dispatcher to enable CORS and have been able to make it work. I would be interested if anyone else has also tried this and may have a cleaner method to enabling CORS support in Web Dispatcher.
Here are the rules that we have implemented.
SetResponseHeader Access-Control-Allow-Origin "https://someserver.company.com"
SetResponseHeader Access-Control-Allow-Credentials true
SetResponseHeader Access-Control-Allow-Methods "GET,POST,PUT,DELETE,OPTIONS"
SetResponseHeader Access-Control-Allow-Headers "accept,x-requested-with,maxdataserviceversion,x-csrf-token,slug"
If %{REQUEST_METHOD} stricmp "OPTIONS"
BEGIN
RegIRewriteUrl (.*) /somelocation-noauth/file.html
else
RegIRewriteUrl ^/cors(.*) /sap/opu/odata$1 [noescape]
End
One of the many fun things with CORS is that the OPTIONS call can't be authenticated. We enabled an external alias for a simple web page and then modified the logon stack to require no authentication for that alias. You can see that above. It would have been nice just to return a 204 with no content in the rules, but we haven't been able to figure that out. Anyone have something that has worked for them?
We would really like to make a more generic origin header response. We would like to use the origin header from the request if it meets some conditions, like *.company.com, but we have been unable to figure out how to do that. Anyone have any ideas?
