added CORS headers to reply

CORS reply
Здесь хеадеры для ручек `/login` и `/json/query`

22 files changed, 76 insertions, 34 deletions

diff --git a/ydb/core/security/login_page.cpp b/ydb/core/security/login_page.cpp
index bff5d178708..ad5290e3a66 100644
--- a/ydb/core/security/login_page.cpp
+++ b/ydb/core/security/login_page.cpp
@@ -179,11 +179,25 @@ public:
         PassAway();
     }
 
+    TString GetCORS() {
+        TStringBuilder res;
+        TString origin = TString(Request.GetHeader("Origin"));
+        if (origin.empty()) {
+            origin = "*";
+        }
+        res << "Access-Control-Allow-Origin: " << origin << "\r\n";
+        res << "Access-Control-Allow-Credentials: true\r\n";
+        res << "Access-Control-Allow-Headers: Content-Type,Authorization,Origin,Accept\r\n";
+        res << "Access-Control-Allow-Methods: OPTIONS, GET, POST\r\n";
+        return res;
+    }
+
     void ReplyCookieAndPassAway(const TString& cookie) {
         TStringStream response;
         TDuration maxAge = (ToInstant(NLogin::TLoginProvider::GetTokenExpiresAt(cookie)) - TInstant::Now());
         response << "HTTP/1.1 200 OK\r\n";
         response << "Set-Cookie: ydb_session_id=" << cookie << "; Max-Age=" << maxAge.Seconds() << "\r\n";
+        response << GetCORS();
         response << "\r\n";
         Result.SetValue(MakeHolder<NMon::TEvHttpInfoRes>(response.Str(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         PassAway();
@@ -197,6 +211,7 @@ public:
         response << "HTTP/1.1 " << status << "\r\n";
         response << "Content-Type: application/json\r\n";
         response << "Content-Length: " << responseBody.Size() << "\r\n";
+        response << GetCORS();
         response << "\r\n";
         response << responseBody;
         Result.SetValue(MakeHolder<NMon::TEvHttpInfoRes>(response.Str(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
diff --git a/ydb/core/viewer/json_acl.h b/ydb/core/viewer/json_acl.h
index c234b04df82..fd79ea2e23a 100644
--- a/ydb/core/viewer/json_acl.h
+++ b/ydb/core/viewer/json_acl.h
@@ -169,7 +169,7 @@ public:
     }
 
     void HandleTimeout() {
-        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
+        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get()), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         PassAway();
     }
 };
diff --git a/ydb/core/viewer/json_browse.h b/ydb/core/viewer/json_browse.h
index 20e1c6e1197..64d423e8537 100644
--- a/ydb/core/viewer/json_browse.h
+++ b/ydb/core/viewer/json_browse.h
@@ -189,7 +189,7 @@ public:
             }
         }
         TStringStream result;
-        result << Viewer->GetHTTPGATEWAYTIMEOUT();
+        result << Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get());
         RenderPendingRequests(result);
         ctx.Send(Event->Sender, new NMon::TEvHttpInfoRes(result.Str(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         Die(ctx);
diff --git a/ydb/core/viewer/json_bscontrollerinfo.h b/ydb/core/viewer/json_bscontrollerinfo.h
index 1daafd2368e..f8fd43ca658 100644
--- a/ydb/core/viewer/json_bscontrollerinfo.h
+++ b/ydb/core/viewer/json_bscontrollerinfo.h
@@ -67,7 +67,7 @@ public:
     }
 
     void HandleTimeout() {
-        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
+        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get()), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         PassAway();
     }
 };
diff --git a/ydb/core/viewer/json_content.h b/ydb/core/viewer/json_content.h
index 79b230f1288..09ef2300d32 100644
--- a/ydb/core/viewer/json_content.h
+++ b/ydb/core/viewer/json_content.h
@@ -122,7 +122,7 @@ private:
     }
 
     void HandleBrowseTimeout(const TActorContext& ctx) {
-        return SendErrorReplyAndDie(Viewer->GetHTTPGATEWAYTIMEOUT(), ctx);
+        return SendErrorReplyAndDie(Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get()), ctx);
     }
 
     void SendErrorReplyAndDie(const TString& error, const TActorContext& ctx) {
diff --git a/ydb/core/viewer/json_counters.h b/ydb/core/viewer/json_counters.h
index 8e5aa527d43..a4f64a1ceb4 100644
--- a/ydb/core/viewer/json_counters.h
+++ b/ydb/core/viewer/json_counters.h
@@ -430,7 +430,7 @@ public:
     }
 
     void Timeout(const TActorContext& ctx) {
-        ctx.Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
+        ctx.Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get()), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         Die(ctx);
     }
 };
diff --git a/ydb/core/viewer/json_describe.h b/ydb/core/viewer/json_describe.h
index 3f6ec6b59c2..26bfd3109b8 100644
--- a/ydb/core/viewer/json_describe.h
+++ b/ydb/core/viewer/json_describe.h
@@ -127,7 +127,7 @@ public:
     }
 
     void HandleTimeout() {
-        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
+        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get()), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         PassAway();
     }
 };
diff --git a/ydb/core/viewer/json_hiveinfo.h b/ydb/core/viewer/json_hiveinfo.h
index 0fa58d281d2..0747d047faf 100644
--- a/ydb/core/viewer/json_hiveinfo.h
+++ b/ydb/core/viewer/json_hiveinfo.h
@@ -96,7 +96,7 @@ public:
     }
 
     void HandleTimeout() {
-        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
+        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get()), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         PassAway();
     }
 };
diff --git a/ydb/core/viewer/json_hivestats.h b/ydb/core/viewer/json_hivestats.h
index 4c2e6230069..b5dcd126e89 100644
--- a/ydb/core/viewer/json_hivestats.h
+++ b/ydb/core/viewer/json_hivestats.h
@@ -74,7 +74,7 @@ public:
     }
 
     void HandleTimeout() {
-        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
+        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get()), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         PassAway();
     }
 };
diff --git a/ydb/core/viewer/json_hotkeys.h b/ydb/core/viewer/json_hotkeys.h
index 714a9aa17c4..b9c0839c6f9 100644
--- a/ydb/core/viewer/json_hotkeys.h
+++ b/ydb/core/viewer/json_hotkeys.h
@@ -155,7 +155,7 @@ public:
     }
 
     void HandleTimeout() {
-        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
+        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get()), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         PassAway();
     }
 };
diff --git a/ydb/core/viewer/json_labeledcounters.h b/ydb/core/viewer/json_labeledcounters.h
index 3b3663bc472..065ea88da5e 100644
--- a/ydb/core/viewer/json_labeledcounters.h
+++ b/ydb/core/viewer/json_labeledcounters.h
@@ -142,7 +142,7 @@ public:
     }
 
     void HandleTimeout(const TActorContext &ctx) {
-        ctx.Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
+        ctx.Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get()), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         Die(ctx);
     }
 };
diff --git a/ydb/core/viewer/json_local_rpc.h b/ydb/core/viewer/json_local_rpc.h
index bab530b2645..5ccee817a3a 100644
--- a/ydb/core/viewer/json_local_rpc.h
+++ b/ydb/core/viewer/json_local_rpc.h
@@ -211,7 +211,7 @@ public:
     }
 
     void HandleTimeout() {
-        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
+        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get()), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         PassAway();
     }
 };
diff --git a/ydb/core/viewer/json_metainfo.h b/ydb/core/viewer/json_metainfo.h
index f507909e245..61b0f8097f1 100644
--- a/ydb/core/viewer/json_metainfo.h
+++ b/ydb/core/viewer/json_metainfo.h
@@ -115,7 +115,7 @@ public:
 
     void HandleTimeout(const TActorContext &ctx) {
         TStringStream result;
-        result << Viewer->GetHTTPGATEWAYTIMEOUT();
+        result << Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get());
         RenderPendingRequests(result);
         ctx.Send(Event->Sender, new NMon::TEvHttpInfoRes(result.Str(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         Die(ctx);
diff --git a/ydb/core/viewer/json_netinfo.h b/ydb/core/viewer/json_netinfo.h
index 8d4ab1ddee1..6acc16e415a 100644
--- a/ydb/core/viewer/json_netinfo.h
+++ b/ydb/core/viewer/json_netinfo.h
@@ -295,7 +295,7 @@ public:
     }
 
     void HandleTimeout() {
-        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
+        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get()), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         PassAway();
     }
 };
diff --git a/ydb/core/viewer/json_pqconsumerinfo.h b/ydb/core/viewer/json_pqconsumerinfo.h
index b7526edf7df..6f6d420e42d 100644
--- a/ydb/core/viewer/json_pqconsumerinfo.h
+++ b/ydb/core/viewer/json_pqconsumerinfo.h
@@ -112,7 +112,7 @@ public:
     }
 
     void HandleTimeout(const TActorContext &ctx) {
-        ctx.Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
+        ctx.Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get()), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         Die(ctx);
     }
 };
diff --git a/ydb/core/viewer/json_query.h b/ydb/core/viewer/json_query.h
index ab831892fb6..0cdafe3882b 100644
--- a/ydb/core/viewer/json_query.h
+++ b/ydb/core/viewer/json_query.h
@@ -97,7 +97,7 @@ public:
             }
         }
         if (query.empty()) {
-            ReplyAndPassAway(HTTPBADREQUEST);
+            ReplyAndPassAway(Viewer->GetHTTPBADREQUEST(Event->Get(), {}, "Bad Request"));
             return;
         }
         NKikimrKqp::TQueryRequest& request = *event->Record.MutableRequest();
@@ -262,7 +262,7 @@ private:
     }
 
     void HandleTimeout() {
-        ReplyAndPassAway(Viewer->GetHTTPGATEWAYTIMEOUT());
+        ReplyAndPassAway(Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get()));
     }
 
     void ReplyAndPassAway(TString data) {
@@ -272,7 +272,7 @@ private:
 
 private:
     void MakeErrorReply(TStringBuilder& out, NJson::TJsonValue& jsonResponse, NKikimrKqp::TEvQueryResponse& record) {
-        out << "HTTP/1.1 400 Bad Request\r\nContent-Type: application/json\r\nConnection: Close\r\n\r\n";
+        out << Viewer->GetHTTPBADREQUEST(Event->Get(), "application/json");
         NJson::TJsonValue& jsonIssues = jsonResponse["issues"];
 
         // find first deepest error
diff --git a/ydb/core/viewer/json_tabletcounters.h b/ydb/core/viewer/json_tabletcounters.h
index 19202d95d16..86ccdd42cc0 100644
--- a/ydb/core/viewer/json_tabletcounters.h
+++ b/ydb/core/viewer/json_tabletcounters.h
@@ -162,7 +162,7 @@ public:
     }
 
     void HandleTimeout(const TActorContext &ctx) {
-        ctx.Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
+        ctx.Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get()), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         Die(ctx);
     }
 };
diff --git a/ydb/core/viewer/json_tenants.h b/ydb/core/viewer/json_tenants.h
index 098d15813c4..94c020096ce 100644
--- a/ydb/core/viewer/json_tenants.h
+++ b/ydb/core/viewer/json_tenants.h
@@ -95,7 +95,7 @@ public:
     }
 
     void HandleTimeout() {
-        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
+        Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get()), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         PassAway();
     }
 };
diff --git a/ydb/core/viewer/json_topicinfo.h b/ydb/core/viewer/json_topicinfo.h
index 28d79a446fc..c0614b756fa 100644
--- a/ydb/core/viewer/json_topicinfo.h
+++ b/ydb/core/viewer/json_topicinfo.h
@@ -87,7 +87,7 @@ public:
     }
 
     void HandleTimeout(const TActorContext &ctx) {
-        ctx.Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
+        ctx.Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get()), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         Die(ctx);
     }
 };
diff --git a/ydb/core/viewer/json_whoami.h b/ydb/core/viewer/json_whoami.h
index fea374b41df..9b4468a1b1a 100644
--- a/ydb/core/viewer/json_whoami.h
+++ b/ydb/core/viewer/json_whoami.h
@@ -44,7 +44,7 @@ public:
     }
 
     void HandleTimeout(const TActorContext &ctx) {
-        ctx.Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
+        ctx.Send(Event->Sender, new NMon::TEvHttpInfoRes(Viewer->GetHTTPGATEWAYTIMEOUT(Event->Get()), 0, NMon::IEvHttpInfoRes::EContentType::Custom));
         Die(ctx);
     }
 };
diff --git a/ydb/core/viewer/viewer.cpp b/ydb/core/viewer/viewer.cpp
index 06f6deba7d0..5006a11d67d 100644
--- a/ydb/core/viewer/viewer.cpp
+++ b/ydb/core/viewer/viewer.cpp
@@ -146,8 +146,10 @@ public:
         return KikimrRunConfig;
     }
 
+    TString GetCORS(const NMon::TEvHttpInfo* request) override;
     TString GetHTTPOKJSON(const NMon::TEvHttpInfo* request, TString response) override;
-    TString GetHTTPGATEWAYTIMEOUT() override;
+    TString GetHTTPGATEWAYTIMEOUT(const NMon::TEvHttpInfo* request) override;
+    TString GetHTTPBADREQUEST(const NMon::TEvHttpInfo* request, TString type, TString response) override;
 
     void RegisterVirtualHandler(
             NKikimrViewer::EObjectType parentObjectType,
@@ -427,12 +429,9 @@ IActor* CreateViewer(const TKikimrRunConfig& kikimrRunConfig) {
     return new TViewer(kikimrRunConfig);
 }
 
-TString TViewer::GetHTTPOKJSON(const NMon::TEvHttpInfo* request, TString response) {
+TString TViewer::GetCORS(const NMon::TEvHttpInfo* request) {
     TStringBuilder res;
     TString origin;
-    res << "HTTP/1.1 200 Ok\r\n"
-        << "Content-Type: application/json; charset=utf-8\r\n"
-        << "X-Worker-Name: " << CurrentWorkerName << "\r\n";
     if (AllowOrigin) {
         origin = AllowOrigin;
     } else if (request && request->Request.GetHeaders().HasHeader("Origin")) {
@@ -444,6 +443,15 @@ TString TViewer::GetHTTPOKJSON(const NMon::TEvHttpInfo* request, TString respons
             << "Access-Control-Allow-Headers: Content-Type,Authorization,Origin,Accept\r\n"
             << "Access-Control-Allow-Methods: OPTIONS, GET, POST\r\n";
     }
+    return res;
+}
+
+TString TViewer::GetHTTPOKJSON(const NMon::TEvHttpInfo* request, TString response) {
+    TStringBuilder res;
+    res << "HTTP/1.1 200 Ok\r\n"
+        << "Content-Type: application/json; charset=utf-8\r\n"
+        << "X-Worker-Name: " << CurrentWorkerName << "\r\n";
+    res << GetCORS(request);
     if (response) {
         res << "Content-Length: " << response.size() << "\r\n";
     }
@@ -454,11 +462,29 @@ TString TViewer::GetHTTPOKJSON(const NMon::TEvHttpInfo* request, TString respons
     return res;
 }
 
-TString TViewer::GetHTTPGATEWAYTIMEOUT() {
-    return TStringBuilder()
-            << "HTTP/1.1 504 Gateway Time-out\r\nConnection: Close\r\n"
-            << "X-Worker-Name: " << FQDNHostName() << ":" << CurrentWorkerName << "\r\n"
-            << "\r\nGateway Time-out\r\n";
+TString TViewer::GetHTTPGATEWAYTIMEOUT(const NMon::TEvHttpInfo* request) {
+    TStringBuilder res;
+    res << "HTTP/1.1 504 Gateway Time-out\r\n"
+        << "Connection: Close\r\n"
+        << "X-Worker-Name: " << FQDNHostName() << ":" << CurrentWorkerName << "\r\n";
+    res << GetCORS(request);
+    res << "\r\nGateway Time-out\r\n";
+    return res;
+}
+
+TString TViewer::GetHTTPBADREQUEST(const NMon::TEvHttpInfo* request, TString contentType, TString response) {
+    TStringBuilder res;
+    res << "HTTP/1.1 400 Bad Request\r\n"
+        << "Connection: Close\r\n";
+    if (contentType) {
+        res << "Content-Type: " << contentType << "\r\n";
+    }
+    res << GetCORS(request);
+    res << "\r\n";
+    if (response) {
+        res << response;
+    }
+    return res;
 }
 
 NKikimrViewer::EFlag GetFlagFromTabletState(NKikimrWhiteboard::TTabletStateInfo::ETabletState state) {
diff --git a/ydb/core/viewer/viewer.h b/ydb/core/viewer/viewer.h
index 3d0971696b4..fd51cb53aeb 100644
--- a/ydb/core/viewer/viewer.h
+++ b/ydb/core/viewer/viewer.h
@@ -153,8 +153,10 @@ public:
         NKikimrViewer::EObjectType objectType,
         const TContentHandler& handler) = 0;
 
-    virtual TString GetHTTPOKJSON(const NMon::TEvHttpInfo* request, TString response = {}   ) = 0;
-    virtual TString GetHTTPGATEWAYTIMEOUT() = 0;
+    virtual TString GetCORS(const NMon::TEvHttpInfo* request) = 0;
+    virtual TString GetHTTPOKJSON(const NMon::TEvHttpInfo* request, TString response = {}) = 0;
+    virtual TString GetHTTPGATEWAYTIMEOUT(const NMon::TEvHttpInfo* request) = 0;
+    virtual TString GetHTTPBADREQUEST(const NMon::TEvHttpInfo* request, TString contentType = {}, TString response = {}) = 0;
 };
 
 void SetupPQVirtualHandlers(IViewer* viewer);
@@ -186,7 +188,6 @@ static const char HTTPOKTEXT[] = "HTTP/1.1 200 Ok\r\nAccess-Control-Allow-Origin
 static const char HTTPFORBIDDENJSON[] = "HTTP/1.1 403 Forbidden\r\nAccess-Control-Allow-Origin: *\r\nContent-Type: application/json; charset=utf-8\r\nConnection: Close\r\n\r\n";
 static const char HTTPGATEWAYTIMEOUT[] = "HTTP/1.1 504 Gateway Time-out\r\nConnection: Close\r\n\r\nGateway Time-out\r\n";
 static const char HTTPBADREQUEST[] = "HTTP/1.1 400 Bad Request\r\nConnection: Close\r\n\r\nBad Request\r\n";
-static const char HTTPBADREQUEST_HEADERS[] = "HTTP/1.1 400 Bad Request\r\nConnection: Close\r\n\r\n";
 
 template <typename ValueType, typename OutputIteratorType>
 void GenericSplitIds(TStringBuf source, char delim, OutputIteratorType it) {