Skip to content

fix: check access to GitLab API in pingWorkbench

Enrique Alcántararequested to merge
check-cors-rules-ping-workbench into main

Issue: Web IDE: Duplicate ```Access-Control-Allow-Orig... (gitlab#558790 - closed)

What does this MR do and why?

It implements a mechanism in the pingWorkbench API that detects when the Web IDE VSCode Workbench hosted in https://[subdomain].cdn.web-ide.gitlab-static.net can't send HTTP requests to the target GitLab instance because it's blocked by CORS configuration issues.

The technique used to identify CORS issues is sending a POST request to the GraphQL endpoint /api/graphql using window.fetch for the VSCode Workbench initialization function. When a fetch HTTP request is blocked by a CORS policy, the function throws a TypeError https://developer.mozilla.org/en-US/docs/Web/API/Window/fetch#exceptions. The VSCode workbench initialization function will catch the TypeError and send an error message back to the pingWorkbench.

When pingWorkbench receives an error message, it throws the error in the GitLab instance context which tells the instance to fallback to single-origin mode. The fallback mechanism is implemented on the GitLab instance side gitlab!200350 (diffs).

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

This Merge Request doesn't introduce user-facing changes.

How to set up and validate locally

I recommend testing these changes in the monolith integration merge request gitlab!200350 (merged). The Merge Request contains testing instructions.

Edited by Enrique Alcántara

Merge request reports