title: Failing to use eZ Platform JS REST API client with cross domain
body: <h1>Context and troubles</h1>
  
  <p>I'm currently building a web application on top of ezPlatform &amp; Symfony.</p>
  
  <p>My goal is now to request this app from an external website using a JS client (using the JS REST client of ezplatform : CAPI.js)</p>
  
  <p>I tested my script localy (on the app itself = same domain) and everything is fine : I can GET and POST data. </p>
  
  <p>But testing this script on an external webiste (CORS requests) didn't work. I am stuck with 2 differents problems :</p>
  
  <ol>
  <li>Server side : The response headers do not contains the Access-Control-Allowed-Methods</li>
  <li>Client side : No session cookies are given within a request</li>
  </ol>
  
  <h1>Details</h1>
  
  <h2>Problem 1 : No header "allow_methods"</h2>
  
  <p>On chrome I always have this error : </p>
  
  <pre><code>XMLHttpRequest cannot load http://api.ezplatform.lan/api/ezp/v2/user/sessions. Response for preflight has invalid HTTP status code 405
  </code></pre>
  
  <p>Note that, on the server side, <strong>nelmio_cors</strong> bundle is used to configures the headers. The configs :</p>
  
  <pre><code>nelmio_cors:
      paths:
          '^/api/ezp/v2/':
              max_age: 3600
              allow_credentials: true
              allow_origin: ['*']
              allow_methods: ['POST', 'PUT', 'GET', 'DELETE', 'OPTIONS']
              expose_headers: []
  </code></pre>
  
  <p>And now, here are the details of a <strong>failing preflight request</strong> :</p>
  
  <pre><code>GENERAL
  Request URL:http://api.ezplatform.lan/api/ezp/v2/user/sessions
  Request Method:OPTIONS
  Status Code:405 Method Not Allowed
  Remote Address:192.168.1.82:80
  
  REPONSE HEADERS
  Access-Control-Allow-Credentials:true
  Access-Control-Allow-Headers:authorization, accept, content-type, x-csrf-token, destination, x-siteaccess
  Access-Control-Allow-Origin:http://www.externalsite.lan
  Access-Control-Max-Age:3600
  Cache-Control:private
  Connection:Keep-Alive
  Content-Length:0
  Content-Type:text/html; charset=UTF-8
  Date:Tue, 13 Dec 2016 15:24:44 GMT
  Keep-Alive:timeout=5, max=99
  Server:Apache/2.4.23 (Ubuntu)
  Vary:X-User-Hash
  
  REQUEST HEADERS
  Accept:*/*
  Accept-Encoding:gzip, deflate, sdch
  Accept-Language:fr-FR,fr;q=0.8,en-US;q=0.6,en;q=0.4
  Access-Control-Request-Headers:content-type
  Access-Control-Request-Method:POST
  Cache-Control:no-cache
  Connection:keep-alive
  Host:api.ezplatform.lan
  Origin:http://www.externalsite.lan
  Pragma:no-cache
  Referer:http://www.externalsite.lan/
  User-Agent:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
  </code></pre>
  
  <p>In the "response headers", there is no <code>Access-Control-Allow-Methods</code> despite of the nelmio_cors configs.</p>
  
  <p>Digging inside the nelmio_cors code I realized that the "allow_methods" config is retrieved but is then overwritten by something else, and here it becomes obscur to me. </p>
  
  <p><a href="https://jira.ez.no/browse/EZP-23889" rel="nofollow noreferrer">This old ezpublish bug</a> maybe give me a clue about the situation : the <em>ezPublishRestBundle</em> does not seems to find any "allowed method", and somehow overwrite the nelmio_cors config.</p>
  
  <p>In the Resprovider.php file, if I force the methods <a href="https://github.com/ezsystems/ezpublish-kernel/blob/master/eZ/Bundle/EzPublishRestBundle/CorsOptions/RestProvider.php#L52" rel="nofollow noreferrer">getAllowedMethods</a> to return this : 
  <code>return ["POST", "PUT", "GET", "DELETE", "OPTIONS"];</code> then I have no more <code>405 error</code> but a very different problem (explained right after this)</p>
  
  <h2>Problem 2 : no session cookies allowed</h2>
  
  <p>With my previous wonderful hack, I can now get a little bit further : my request are allowed but some of them are still failing. </p>
  
  <p>I noticed that no session cookie is passed inside the requests (which is the normal behaviour testing on the same domain). </p>
  
  <p>This times it seems to come from the CAPI.js file : the <code>XmlHttpRequest</code> object never has the property <code>withCredentials</code> to true.</p>
  
  <p>If I add this code <code>XHR.withCredentials = true;</code> in CAPI.js before the request is send, then it seems to be fine.</p>
  
  <h1>Conclusion</h1>
  
  <p>I really wonder if the ez Platform rest client has been designed to be used for cross domain, but it would be very surprising if not.</p>
  
  <p>So I must do something wrong, and if someone can explain me what, I would be extemely grateful :)</p>