<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"><div><div>Hi,</div><div>Just looping back around on this thread to close out a couple of issues.</div><div>First, I’m a little embarrassed to admit it, but the 403 error I was getting on the search was because I was not actually authenticated as an admin user. Oops…</div><div>Second, in regards to resolve the cross domain request issues in a production environment, it seems like there are basically two ways to do this:</div><ol><li>Set up a proxy in front of the backend, as Brian suggested.</li><li>Make some changes to the core AS code to include a gem to handle CORS [1] [2]</li></ol><div>At the moment we don’t have a pressing need to resolve the cross-origin issue, but if/when we do I’ll write something up on how we did it and circulate.</div><div><br></div><div>1 <a href="https://github.com/cyu/rack-cors">https://github.com/cyu/rack-cors</a></div><div>2 <a href="https://github.com/britg/sinatra-cross_origin">https://github.com/britg/sinatra-cross_origin</a></div><div><div><div><br></div><div>Hillel Arnold</div></div><div>Lead Digital Archivist</div><div>Rockefeller Archive Center</div></div></div><div><br></div><span id="OLK_SRC_BODY_SECTION"><div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span style="font-weight:bold">From: </span> <Arnold>, Hillel Arnold <<a href="mailto:harnold@rockarch.org">harnold@rockarch.org</a>><br><span style="font-weight:bold">Reply-To: </span> Archivesspace Users Group <<a href="mailto:archivesspace_users_group@lyralists.lyrasis.org">archivesspace_users_group@lyralists.lyrasis.org</a>><br><span style="font-weight:bold">Date: </span> Friday, February 13, 2015 at 12:02 PM<br><span style="font-weight:bold">To: </span> Archivesspace Users Group <<a href="mailto:archivesspace_users_group@lyralists.lyrasis.org">archivesspace_users_group@lyralists.lyrasis.org</a>><br><span style="font-weight:bold">Subject: </span> Re: [Archivesspace_Users_Group] ArchivesSpace API and XMLHttpRequests<br></div><div><br></div><div><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"><div><div><div>Hi Nathan,</div><div>I don’t have a good answer to that question other than that I wanted to keep things as simple as possible.</div></div></div><div>To follow up on the issue I was experiencing with a permissions error for certain API requests, it seems very likely this is a server configuration thing on our end. I’m able to successfully make those calls when running AS on my local machine. I’ll reply
back to this list when I’ve figured both that and the CORS issue out.</div><div>Brian – thanks for sending the demo. Your client library is super helpful, and I hope will continue to see development/release at some point. If there’s anything I can do to help make that happen, let me know!</div><div><br></div><div>Hillel</div><div><br></div><span id="OLK_SRC_BODY_SECTION"><div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span style="font-weight:bold">From: </span>Nathan Stevens <<a href="mailto:ns96@nyu.edu">ns96@nyu.edu</a>><br><span style="font-weight:bold">Reply-To: </span>Archivesspace Users Group <<a href="mailto:archivesspace_users_group@lyralists.lyrasis.org">archivesspace_users_group@lyralists.lyrasis.org</a>><br><span style="font-weight:bold">Date: </span>Thursday, February 12, 2015 at 3:29 PM<br><span style="font-weight:bold">To: </span>Archivesspace Users Group <<a href="mailto:archivesspace_users_group@lyralists.lyrasis.org">archivesspace_users_group@lyralists.lyrasis.org</a>><br><span style="font-weight:bold">Subject: </span>Re: [Archivesspace_Users_Group] ArchivesSpace API and XMLHttpRequests<br></div><div><br></div><p dir="ltr">Besides the elegance of using a pure javascript/html solution you ever consider just using a simple php script to wrap all the calls to the aspace backend since you already planning on deploying on Apache anyway?</p><div class="gmail_quote">On Feb 11, 2015 6:24 PM, "Brian Hoffman" <<a href="mailto:brianjhoffman@gmail.com">brianjhoffman@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Hillel,
<div><br></div><div>If you are using Apache to server the index of your SPA app, your best bet might be to use ProxyPass statements in your Apache config to get around the X-domain issues. Example:</div><div><br></div><div><a href="http://yourserver.edu/spa/index.html" target="_blank">http://yourserver.edu/spa/index.html</a></div><div><br></div><div><a href="http://yourserver.edu/aspaceproxy" target="_blank">http://yourserver.edu/aspaceproxy</a></div><div><br></div><div>which proxies and reverse proxies to:</div><div><br></div><div><a href="http://youraspaceserver.edu" target="_blank">http://youraspaceserver.edu</a></div><div><br></div><div>Disclaimer: this isn't really something I have a lot of experience with. </div><div><br></div><div>Regarding the authentication, I threw together a little demo using a client library I wrote - maybe it will help:</div><div><br></div><div><a href="https://github.com/quoideneuf/asapi/releases/tag/spa-demo" target="_blank">https://github.com/quoideneuf/asapi/releases/tag/spa-demo</a><br></div><div><br></div><div>Brian</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Feb 11, 2015 at 10:16 AM, Arnold, Hillel <span dir="ltr">
<<a href="mailto:harnold@rockarch.org" target="_blank">harnold@rockarch.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif"><div><div><div>Hi Brian,</div></div></div><div>Thanks for your quick response, and for the tip about Chrome. I was able to sidestep the cross-domain issue for now, but if anyone has tips on how to get this working in production that would be great to know for the future. I should mention that I tried
changing the Access-Control-Allow-Origin header in Apache, but that didn’t seem to have any effect because ArchivesSpace is running within Jetty (I think).</div><div>As far as getting something back via a URL like /search?q=query&page=1, I am still having no luck. I was able to successfully authenticate (and I’m authenticating as an admin user), and am sending the session key back via a header. I’m able to successfully
make other calls, but that particular one is not working. Any ideas?</div><div><br></div><div>Hillel</div><div><br></div><span><div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt"><span style="font-weight:bold">From: </span>Brian Hoffman <<a href="mailto:brianjhoffman@gmail.com" target="_blank">brianjhoffman@gmail.com</a>><br><span style="font-weight:bold">Reply-To: </span>Archivesspace Users Group <<a href="mailto:archivesspace_users_group@lyralists.lyrasis.org" target="_blank">archivesspace_users_group@lyralists.lyrasis.org</a>><br><span style="font-weight:bold">Date: </span>Tuesday, February 10, 2015 at 10:19 PM<br><span style="font-weight:bold">To: </span>Archivesspace Users Group <<a href="mailto:archivesspace_users_group@lyralists.lyrasis.org" target="_blank">archivesspace_users_group@lyralists.lyrasis.org</a>><br><span style="font-weight:bold">Subject: </span>Re: [Archivesspace_Users_Group] ArchivesSpace API and XMLHttpRequests<br></div><div><div><div><br></div><div dir="ltr">Hi Hillel,
<div><br></div><div>For development purposes, you can get around the cross domain issue by starting Chrome with the disable-web-security flag:</div><div><br></div><div><a href="http://stackoverflow.com/questions/3102819/disable-same-origin-policy-in-chrome" target="_blank">http://stackoverflow.com/questions/3102819/disable-same-origin-policy-in-chrome</a><br></div><div><br></div><div>For the Postman case you described, it sounds like you need to hit the login endpoint first, get back the session key, and then add that to your search request headers (there's a little dropdown in Postman for this) using 'X-ArchivesSpace-Session' as the
header key.</div><div><br></div><div>Hope this helps,</div><div><br></div><div>Brian</div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Feb 10, 2015 at 5:46 PM, Arnold, Hillel <span dir="ltr">
<<a href="mailto:harnold@rockarch.org" target="_blank">harnold@rockarch.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif"><div>Hi everyone,</div><div>I’ve been hacking together a proof-of-concept single page web app which makes a couple of API calls against ArchivesSpace and returns/displays a bunch of data about a particular archival component.</div><div>Because I am not really a programmer, I’m just making a XMLHttpRequest with JQuery. However, I’m running into a couple problems.</div><div>First, when I try to post to my username and password so I can get back a session token, I’m getting an error related to cross domain requesting saying the requested resource doesn’t have an Access-Control-Allow-Origin header set. It seems like I’d need
to set those header somewhere server-side (maybe in the app config settings somewhere), but I’m not sure where exactly that would be. The existing examples out there for working with the ArchivesSpace API seem to mostly be command-line tools, which wasn’t
really helping me. I’m sure there are people out there who have done this, either specifically with ArchivesSpace or with other Ruby apps, so if you know how to do this or can point me to a link which tells me how to do it, I’d be most grateful!</div><div>Second, unless I am reading the documentation wrong (which is very likely), I think I should be able to make a get request like:</div><div><a href="http://some_url:8089/search?q=cats&page=1" target="_blank">http://some_url:8089/search?q=cats&page=1</a> and get back search results. However, when I test that URL out in Postman I’m getting a 403 error. Am I missing something here?</div><div><br></div><div>Thanks for any help!</div><span><font color="#888888"><div><div><div><br></div><div>Hillel Arnold</div></div><div>Lead Digital Archivist</div><div>Rockefeller Archive Center</div></div></font></span></div><br>
_______________________________________________<br>
Archivesspace_Users_Group mailing list<br><a href="mailto:Archivesspace_Users_Group@lyralists.lyrasis.org" target="_blank">Archivesspace_Users_Group@lyralists.lyrasis.org</a><br><a href="http://lyralists.lyrasis.org/mailman/listinfo/archivesspace_users_group" target="_blank">http://lyralists.lyrasis.org/mailman/listinfo/archivesspace_users_group</a><br><br></blockquote></div><br><br clear="all"><div><br></div>
-- <br><div>Brian Hoffman<br><a href="mailto:brianjhoffman@gmail.com" target="_blank">brianjhoffman@gmail.com</a></div></div></div></div></span></div><br>
_______________________________________________<br>
Archivesspace_Users_Group mailing list<br><a href="mailto:Archivesspace_Users_Group@lyralists.lyrasis.org" target="_blank">Archivesspace_Users_Group@lyralists.lyrasis.org</a><br><a href="http://lyralists.lyrasis.org/mailman/listinfo/archivesspace_users_group" target="_blank">http://lyralists.lyrasis.org/mailman/listinfo/archivesspace_users_group</a><br><br></blockquote></div><br><br clear="all"><div><br></div>
-- <br><div>Brian Hoffman<br><a href="mailto:brianjhoffman@gmail.com" target="_blank">brianjhoffman@gmail.com</a></div></div><br>
_______________________________________________<br>
Archivesspace_Users_Group mailing list<br><a href="mailto:Archivesspace_Users_Group@lyralists.lyrasis.org">Archivesspace_Users_Group@lyralists.lyrasis.org</a><br><a href="http://lyralists.lyrasis.org/mailman/listinfo/archivesspace_users_group" target="_blank">http://lyralists.lyrasis.org/mailman/listinfo/archivesspace_users_group</a><br><br></blockquote></div></span></div></div></span></body></html>