FHIR Chat · FHIR.js middleware allowing Headers

Stream: javascript

Topic: FHIR.js middleware allowing Headers

Cole Diffin (May 07 2016 at 02:46):

I wanted to ask if there was a case to allow user configurable headers to be passed from the config to the Http client. It seems like it is very straight forward to add this, by adding a copyConfig line to the config middleware, however, I am not sure if there are other implications or if it has been a conscious decision to not include headers at this time.

Josh Mandel (May 07 2016 at 05:15):

I don't currently have a use case, but I think it's a good addition.

Brian Postlethwaite (May 07 2016 at 18:38):

This would need to be aware of the CORS implications of this on servers too.

Cole Diffin (May 08 2016 at 21:52):

Can you Elaborate @Brian Postlethwaite ? CORS is handeled by the serve in my experience. (Or are you referring to the fact that if you add some extra headers, that the srver has t explicitly allow those headers?

Brian Postlethwaite (May 09 2016 at 04:15):

Yes, if you want to add extra headers the CORS has to explicitly permit them. There are no wildcards permitted in there for the headers if i remember rightly. And if you ask for one the server doesn'r permit, it doesn't just mask it, it blocks the call with an access denied message.
(Could be wrong, but think this is what I experienced recently in IE, could also be browser specific)

Cole Diffin (May 09 2016 at 06:19):

New PR with Headers support.

I've also raised some tickets on github to track recent additions potentially missing from the angular adapter

Cole Diffin (May 09 2016 at 06:23):

Yep that recollection of CORS and headers matches my understanding.

However, in some situations, it is required (or beneficial) to supply headers along with the request. For example, the server that I work with, requires an API key to be included in requests depending on the method that I authorise to the server with. Without the ability to add custom servers to my request, I don't have a way to use fhir.js with that particular authorization mechanism. I'll add a note to the readme about CORS requirements.

Thanks for your input :-)