Skip to content

Add CORS headers to HTTP exceptions - #16339

Merged
miketheman merged 10 commits into
pypi:mainfrom
ryanking13:cors-errors
Aug 19, 2024
Merged

Add CORS headers to HTTP exceptions#16339
miketheman merged 10 commits into
pypi:mainfrom
ryanking13:cors-errors

Conversation

@ryanking13

@ryanking13 ryanking13 commented Jul 25, 2024

Copy link
Copy Markdown
Contributor

Resolve #14229

This adds CORS headers to the response when warehouse returns404, 410, 50x responses.

I added the same CORS headers to simple APIs in #13222, but they were not applied on an error case.

Context

In pyodide, we are implementing a fallback option for package index, so that if a package is not available in one package index, then search it in another package index. However, without the CORS headers, it is impossible to distinguish the 404 Not Found error.

cc: @Carreau

@ryanking13
ryanking13 requested a review from a team as a code owner July 25, 2024 15:24

@Carreau Carreau left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for looking into this, that is great !

I haven't tested locally yet though.

Comment thread tests/unit/legacy/api/test_json.py Outdated
Comment thread warehouse/views.py
@ryanking13

Copy link
Copy Markdown
Contributor Author

@di Can I ask for your review when you have time?

Comment thread warehouse/views.py
@miketheman miketheman added the security Security-related issues and pull requests label Aug 16, 2024
@ryanking13
ryanking13 requested a review from miketheman August 19, 2024 08:42
@miketheman
miketheman merged commit 7541f85 into pypi:main Aug 19, 2024
@ryanking13
ryanking13 deleted the cors-errors branch August 20, 2024 09:25
@Carreau

Carreau commented Aug 20, 2024

Copy link
Copy Markdown
Contributor

Thanks !

Carreau added a commit to Carreau/micropip that referenced this pull request Aug 21, 2024
Now that warehouse set cors to 404, (pypi/warehouse#16339)
we need to change the checked exceptions as there is no more network
errors.
Carreau added a commit to Carreau/micropip that referenced this pull request Aug 21, 2024
Now that warehouse set cors to 404, (pypi/warehouse#16339)
we need to change the checked exceptions as there is no more network
errors.
Carreau added a commit to Carreau/micropip that referenced this pull request Sep 16, 2024
Now that warehouse set cors to 404, (pypi/warehouse#16339)
we need to change the checked exceptions as there is no more network
errors.
Carreau added a commit to Carreau/micropip that referenced this pull request Sep 18, 2024
Now that warehouse set cors to 404, (pypi/warehouse#16339)
we need to change the checked exceptions as there is no more network
errors.
Carreau added a commit to Carreau/micropip that referenced this pull request Sep 18, 2024
Now that warehouse set cors to 404, (pypi/warehouse#16339)
we need to change the checked exceptions as there is no more network
errors.
Carreau added a commit to Carreau/micropip that referenced this pull request Sep 19, 2024
Currently only the not_in_pyodide will raise on non-success, because this
is the default behavior of urllib, the in_pyodide will not, so I added a
raise_for_status.

It is better to raise, as otherwise the package parser will potentially
get proper URL and not manage to parse it, and decide there is no
wheels, while we actually just got an error (404, or maybe 500).

In addition wraps both case in a custom local HttpStatusError, so that
we can actually catch these errors in the right places when we encounter
them.

Also add handling for PyPI 404

Now that warehouse set cors to 404, (pypi/warehouse#16339)
we need to change the checked exceptions as there is no more network
errors.
Carreau added a commit to Carreau/micropip that referenced this pull request Sep 19, 2024
Currently only the not_in_pyodide will raise on non-success, because this
is the default behavior of urllib, the in_pyodide will not, so I added a
raise_for_status.

It is better to raise, as otherwise the package parser will potentially
get proper URL and not manage to parse it, and decide there is no
wheels, while we actually just got an error (404, or maybe 500).

In addition wraps both case in a custom local HttpStatusError, so that
we can actually catch these errors in the right places when we encounter
them.

Also add handling for PyPI 404

Now that warehouse set cors to 404, (pypi/warehouse#16339)
we need to change the checked exceptions as there is no more network
errors.
Carreau added a commit to Carreau/micropip that referenced this pull request Sep 19, 2024
Currently only the not_in_pyodide will raise on non-success, because this
is the default behavior of urllib, the in_pyodide will not, so I added a
raise_for_status.

It is better to raise, as otherwise the package parser will potentially
get proper URL and not manage to parse it, and decide there is no
wheels, while we actually just got an error (404, or maybe 500).

In addition wraps both case in a custom local HttpStatusError, so that
we can actually catch these errors in the right places when we encounter
them.

Also add handling for PyPI 404

Now that warehouse set cors to 404, (pypi/warehouse#16339)
we need to change the checked exceptions as there is no more network
errors.
Carreau added a commit to Carreau/micropip that referenced this pull request Sep 20, 2024
Currently only the not_in_pyodide will raise on non-success, because this
is the default behavior of urllib, the in_pyodide will not, so I added a
raise_for_status.

It is better to raise, as otherwise the package parser will potentially
get proper URL and not manage to parse it, and decide there is no
wheels, while we actually just got an error (404, or maybe 500).

In addition wraps both case in a custom local HttpStatusError, so that
we can actually catch these errors in the right places when we encounter
them.

Also add handling for PyPI 404

Now that warehouse set cors to 404, (pypi/warehouse#16339)
we need to change the checked exceptions as there is no more network
errors.
ryanking13 added a commit to pyodide/micropip that referenced this pull request Oct 5, 2024
* fetch_string_and_headers compat: raise in and out of pyodide

Currently only the not_in_pyodide will raise on non-success, because this
is the default behavior of urllib, the in_pyodide will not, so I added a
raise_for_status.

It is better to raise, as otherwise the package parser will potentially
get proper URL and not manage to parse it, and decide there is no
wheels, while we actually just got an error (404, or maybe 500).

In addition wraps both case in a custom local HttpStatusError, so that
we can actually catch these errors in the right places when we encounter
them.

Also add handling for PyPI 404

Now that warehouse set cors to 404, (pypi/warehouse#16339)
we need to change the checked exceptions as there is no more network
errors.

* Remove compat with Pyodide < 0.27

* Update test_compat.py

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

---------

Co-authored-by: Gyeongjae Choi <def6488@gmail.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security Security-related issues and pull requests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Next.js fetch package CORS error

3 participants