2abb829a5d
CORS doesn't really work with swift right now. OPTIONS calls for the most part work but for so called "simple cross-site requests" (i.e. those that don't require a pre-flight OPTIONS request) Swift always returns the Origin it was given as the Access-Control-Allow-Origin in the response. This makes CORS "work" for these requests but if you actually wanted the javascript user agent to restrict anything for you it wouldn't be able to! You can duplicate the issue with updated CORS test page: http://docs.openstack.org/developer/swift/cors.html#test-cors-page And a public container with an 'X-Container-Meta-Access-Control-Allow-Origin' that does NOT match the webserver hosting the test-cors-page. e.g. with a public container that accepts cross-site requests from "example.com": `swift post cors-container -m access-control-allow-origin:example.com -r .r:*` You could point your browser at a copy of the test-cors-page on your filesystem (the browser will will send 'Origin: null') Without a token the XMLHttpRequest will not request any custom headers (i.e. Access-Control-Request-Headers: x-auth-token) and the request will be made with-out a preflight OPTIONS request (which Swift would have denied anyway because the origin's don't match) i.e. fill in "http://saio:8080/v1/AUTH_test/cors-container" for "URL" and leave "Token" blank. You would expect that the browser would not complete the request because "Origin: null" does not match the configured "Access-Control-Allow-Origin: example.com" on the container metadata, and indeed with this patch - it won't! Also: The way cors is set up does not play well with certain applications for swift. If you are running a CDN on top of swift and you have the Access-Control-Allow-Origin cors header set to * then you probably want the * to be cached on the the CDN, not the Origin that happened to result in an origin request. Also: If you were unfortunate enough to allow cors headers to be saved directly onto objects then this allows them to supersede the headers coming from the container. NOTE: There is a change is behavior with this patch. Because its cors, a spec that was created only to cause annoyance to all, I'll write out what's being changed and hopefully someone will speak up if it breaks there stuff. previous behavior: When a request was made with a Origin header set the cors_validation decorator would always add that origin as the Access-Control-Allow-Origin header in the response- whether the passed origin was a match with the container's X-Container-Meta-Access-Control-Allow-Origin or not, or even if the container did not have CORS set up at all. new behavior: If strict_cors_mode is set to True in the proxy-server.conf (which is the default) the cors_validation decorator will only add the Access-Control-Allow-Origin header to the response when the request's Origin matches the value set in X-Container-Meta-Access-Control-Allow-Origin. NOTE- if the container does not have CORS set up it won't just magically start working. Furthremore, if the Origin doesn't match the Access-Control-Allow-Origin - a successfully authorized request (either by token or public ACL) won't be *denied* - it just won't include the Access-Control-Allow-Origin header (it's up to the security model in the browser to cancel the request if the response doesn't include a matching Allow-Origin header). On the other hand, if you want to restrict requests with CORS, you can actually do it now. If you are worried about breaking current functionality you must set: strict_cors_mode = False in the proxy-server.conf. This will continue with returning the passed in Origin as the Access-Control-Allow-Origin in the response. previous: If you had X-Container-Meta-Access-Control-Allow-Origin set to * and you passed in Origin: http://hey.com you'd get Access-Control-Allow-Origin: http://hey.com back. This was true for both OPTIONS and regular reqs. new: With X-Container-Meta-Access-Control-Allow-Origin set to * you get * back for both OPTIONS and regular reqs. previous: cors headers saved directly onto objects (by allowing them to be saved via the allowed_headers config in the object-server conf) would be overridden by whatever container cors you have set up. new: For regular (non-OPTIONS) calls the object headers will be kept. The container cors will only be applied to objects without the 'Access-Control-Allow-Origin' and 'Access-Control-Expose-Headers' headers. This behavior doesn't make a whole lot of sense for OPTIONS calls so I left that as is. I don't think that allowing cors headers to be saved directly onto objects is a good idea and it should be discouraged. DocImpact Change-Id: I9b0219407e77c77a9bb1133cbcb179a4c681c4a8
Swift
A distributed object storage system designed to scale from a single machine to thousands of servers. Swift is optimized for multi-tenancy and high concurrency. Swift is ideal for backups, web and mobile content, and any other unstructured data that can grow without bound.
Swift provides a simple, REST-based API fully documented at http://docs.openstack.org/.
Swift was originally developed as the basis for Rackspace's Cloud Files and was open-sourced in 2010 as part of the OpenStack project. It has since grown to include contributions from many companies and has spawned a thriving ecosystem of 3rd party tools. Swift's contributors are listed in the AUTHORS file.
Docs
To build documentation install sphinx (pip install sphinx), run
python setup.py build_sphinx, and then browse to /doc/build/html/index.html.
These docs are auto-generated after every commit and available online at
http://docs.openstack.org/developer/swift/.
For Developers
The best place to get started is the "SAIO - Swift All In One". This document will walk you through setting up a development cluster of Swift in a VM. The SAIO environment is ideal for running small-scale tests against swift and trying out new features and bug fixes.
You can run unit tests with .unittests and functional tests with
.functests.
Code Organization
- bin/: Executable scripts that are the processes run by the deployer
- doc/: Documentation
- etc/: Sample config files
- swift/: Core code
- account/: account server
- common/: code shared by different modules
- middleware/: "standard", officially-supported middleware
- ring/: code implementing Swift's ring
- container/: container server
- obj/: object server
- proxy/: proxy server
- test/: Unit and functional tests
Data Flow
Swift is a WSGI application and uses eventlet's WSGI server. After the
processes are running, the entry point for new requests is the Application
class in swift/proxy/server.py. From there, a controller is chosen, and the
request is processed. The proxy may choose to forward the request to a back-
end server. For example, the entry point for requests to the object server is
the ObjectController class in swift/obj/server.py.
For Deployers
Deployer docs are also available at http://docs.openstack.org/developer/swift/. A good starting point is at http://docs.openstack.org/developer/swift/deployment_guide.html
You can run functional tests against a swift cluster with .functests. These
functional tests require /etc/swift/test.conf to run. A sample config file
can be found in this source tree in test/sample.conf.
For Client Apps
For client applications, official Python language bindings are provided at http://github.com/openstack/python-swiftclient.
Complete API documentation at http://docs.openstack.org/api/openstack-object-storage/1.0/content/
For more information come hang out in #openstack-swift on freenode.
Thanks,
The Swift Development Team