Custom response headers about rabbitmq-management

[uvzubovs]

+10

Being able to access management API from JavaScript (XHR) is very useful in developing dashboards that complement Rabbit management UI and don't provide access to queue/exchange manipulation, which is the #1 reason for restricting access to management UI in production.

[michaelklishin]

@carlhoerberg sounds like I good idea. I think it may be noticed quicker if you post this to the mailing list.

[simonmacmullen]

Well, it would certainly be a bad idea to add "Access-Control-Allow-Origin: *"; this is a security thing after all. Allowing you to configure mgmt so that it allows custom headers to be set would be OK I guess.

[carlhoerberg]

indeed, just didn't want to make it more complicated.. maybe just a configuration option for the host value is enough.

[ceefour]

+1 for this. We're already using pure HTML5 RabbitMQ clients now using SockJS+stomp.js but it can only connect to the same RabbitMQ server as the web server IP due to this issue :(

[ceefour]

Sorry for unassigning @simonmacmullen. It must've been a GitHub bug... as I have no privileges whatsoever in this repo

[ceefour]

Mailing list thread: http://rabbitmq.1065348.n5.nabble.com/CORS-in-the-mgmt-http-api-td25693.html

However I just noticed that this is talking about rabbitmq-management, while what I'm looking for is CORS for rabbitmq_web_stomp plugin.

[michaelklishin]

@ceefour file a similar issue there, explaining what the current limitations are.

[michaelklishin]

Now that rabbitmq/rabbitmq-web-stomp#12 is fixed, I think this can be closed unless someone comes up with more specific improvements.