Custom Header support

[netwolfuk]

Description

I'm writing an API that integrates OpenHAB's HaBot with Signal. I plan to publish it as a container along with a compose file that shows users how to run the containers together, but ultimately I can't enforce users to run a reverse proxy.

It would therefore be helpful to be able to configure headers like CORS in this API gateway so that a UI can talk to SSA

Solution

Add the ability to set headers that can be returned by the server. I looked at the headers information in the readme, but that appears to be mainly related to request headers and mapping those to Auth keys.

We'd also need to be able to enable the OPTIONS verb to handle preflight requests. Some knowledge of which endpoints support which methods would be good. Maybe we need some sort of mapping configuration, unless SSA already knows the verbs each endpoint supports and can reply correctly to an OPTIONS request.

Alternatives

• Of course we can do this in the fronting server, but even I have not setup Apache yet, and I have the best intentions.

• Alternatively host all services on one URL. Eg, Apache (or nginx or haproxy) fronting all of the following.

  • SCRA
  • Openhab
  • SSA
  • My Signal HaBot bridge

Additional Context

Initially I just want to build a small UI to configure my bridge. It needs to call SSA to get groups info and show/allow configuration of trusted numbers. Maybe signal groups creation and permissions.

A stretch goal might be the ability to do all the setup of SCRA from a UI too. I'm referring to requesting the Auth SMS/voice call and doing the captcha, etc.

[CodeShellDev]

Hi there @netwolfuk,

I think this can be done without implementing CORS specifically, instead
it would be better if the user would set the CORS headers as response headers in the configuration file.
This would allow the user to set any kind of header not just CORS and would therefor meet my unspoken rule of dynamic and flexible design over hardcoded specific features.

About the OPTIONS method, the issue is that, since SSA is only an API gateway proxy it doesn‘t know what headers, etc. are allowed, so maybe it would be enough to just return 204 No Content on OPTIONS request with some headers, but for that I‘d need more input what specifically you need (what headers, …).
But here I am also wondering how to not make it very specific, do you really need preflight? I mean in the end it would just return 204 + response headers defined in config.

A Web Interface has been considered, that would however belong into its own issue and I guess it wouldn‘t include any captcha solving etc., it would just be a dashboard for analytics and also some helpers for inspecting requests and creating templates or mappings based on the request body.

Hope this helps!

[CodeShellDev]

So to custom response headers: Yes, that was on my mind for a long time and I guess will be then added to v1.6.0.

[CodeShellDev]

Also just looked into HaBot – Cool idea! 👍

Just out of curiosity, why is it that you can‘t force the usage of a Reverse Proxy and why does CORS then helps with this? I mean they would still need SSA to communicate with it, to implement CORS. Or do you mean another additional Reverse Proxy would be needed? Last one: Why do you need them to use a Reverse Proxy?