<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">This a security measure in bmcweb to prevent cross site scripting. If you’re running phosphor-webui from another machine, you’re essentially running cross site
scripting as a development measure, which is exactly what the BMC sees, and the browser squashes the request as a suspected XSS attack.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">The easiest way to make this work for testing is to go to this file:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><a href="https://github.com/openbmc/bmcweb/blob/master/include/security_headers_middleware.hpp">https://github.com/openbmc/bmcweb/blob/master/include/security_headers_middleware.hpp</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">and comment out lines 42-44, which set headers to prevent the bmc squashing the request.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">It’s been a while since I’ve developed like that, but you likely also need to add a couple headers as well<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">req.addHeader(“Access-Control-Allow-Origin”, “*”);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">req.addHeader(“Access-Control-Allow-Methods”, “GET, POST, PUT, PATCH”);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I know you’re not the first person to hit this unexpectedly. If you get a header recipe that allows development, it would be great if you could codify it into
an option called BMC_INSECURE_ALLOW_XSS, add it to the build configuration, and put it up for a gerrit review; I’m fairly certain it would help others.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">-Ed<o:p></o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></a></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><a name="_____replyseparator"></a><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> AKASH G J [mailto:akashgj91@gmail.com]
<br>
<b>Sent:</b> Tuesday, August 7, 2018 3:13 AM<br>
<b>To:</b> Tanous, Ed <ed.tanous@intel.com><br>
<b>Cc:</b> openbmc@lists.ozlabs.org<br>
<b>Subject:</b> Re: Phosphor Web-ui: Server unreachable<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Hi Ed,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Sorry for the late reply. I was on leave for last week.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I am hosting phosphor-webui on a different machine and trying to connect the BMC board using its IP address. I am using bmcweb platform. When I tried to login, the following message appeared in browser console.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at
<a href="https://%3cBMC-IP%3e/login">https://<BMC-IP>/login</a>. (Reason: CORS request did not succeed).<br>
<unavailable> activity-stream.bundle.js:3170:9<br>
CSI/tbsd_ cb=gapi.loaded_0:458:127<br>
CSI/_tbnd cb=gapi.loaded_0:458:127<br>
CSI/tbsd_ cb=gapi.loaded_0:458:127<br>
CSI/_tbnd cb=gapi.loaded_0:458:127<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks and Regards,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Akash<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Mon, Jul 30, 2018 at 11:06 PM, Ed Tanous <<a href="mailto:ed.tanous@intel.com" target="_blank">ed.tanous@intel.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal">On 07/30/2018 05:04 AM, AKASH G J wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">Hi Team,<br>
<br>
I added phosphor-webui into the Linux image and set up client side of the web interface. In the client side of web interface I could able to give the IP address, username and password. After entering all those details, it is showing "server unreachable". But
I could able to ping the server board and ssh into the system. Please someone help to resolve the problem.<br>
<br>
<br>
<br>
Thanks and Regards,<br>
<br>
Akash G J<o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal">We need some basic information to help you troubleshoot. You might also find faster responses on irc; Most of the people involved in the web infrastructure are online there.<br>
<br>
1. What platform are you using?<br>
2. If not one of the upstream platforms, which web server is your platform using? (probably one of phosphor-rest, bmcweb, or phosphor-rest+nginx)<br>
3. When you open up the debugger window in your chosen browser (usually the F12 key) then go to the network tab and attempt to log in, what do you see? You should see an attempt to get to the /login url, with some kind of error code (maybe 401, maybe 500,
maybe something else). We'll need that to help troubleshoot.<br>
4. Is there anything else strange about your setup that you might think would contribute to your issue?<br>
5. Are you hosting phosphor-webui from a different machine from the BMC. Depending on what server you are using, there are likely security settings preventing cross site scripting that are blocking you.<o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>