Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Send CORs headers for browser applications

Abierto
  • ¿Algo no está bien?
#266 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
25/100
Tipo de issue
Nueva funcionalidad
Claridad
Necesita aclaración
Estado de actividad
Estancado
Stack tecnológico
c, javascript
Área
backend-api-design, networking, security

Línea de trabajo

Comienza rastreando el manejo de respuestas HTTP de CUPS para los endpoints IPP y revisando los requisitos de CORS enlazados en el issue. Define cómo se configurarían y validarían los orígenes de confianza; se considera terminado cuando las aplicaciones de navegador puedan enviar solicitudes IPP con los headers requeridos sin exponer ampliamente las impresoras.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement priority-low

It would really simplify things for users of applications served through the browser that need to print documents if some sort of CORs configuration could be enabled via CUPs.

If you aren't familiar with CORs - this is solved simply by adding a few HTTP headers. Ideally, headers are only allowed for a set of trusted domains which can be enabled in some fashion by the user (i.e. the user needs to allow prints from "fancyprintjobs.example.com"). This page does a better job describing it than I could do here: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

If it is helpful, I can go into more detail about the specific header key/values required to facilitate communication between the application running inside the browser and CUPs. However, know it is simply adding a couple of http headers to the response based on the domain requests are made from.

The browser respects a CORs policy when allowing http requests from an application (i.e. javascript code) to endpoints served from a different domain than the application. When CORs is enabled, javascript applications are able to print directly to CUPs. Without CORs, browsers disallow the ability to submit IPP jobs to CUPs from an application running in the browser context.

Currently, users have two options - they can manually print each document by downloading it via the browser and using a local program to print. This is slow and requires the user to set the print settings for each type of job. Since the remote application already knows how it should be printed (and can set these settings automatically via IPP, it is frustrating for - and confusing to many - users to configure the printer correctly for different types of documents.

The better option is to allow the application to print directly via IPP. However, CORs restrictions make this difficult since they are not considered by CUPs.

Since CUPs does not allow CORs configuration, the user must do one of the following at present:

  1. (easiest approach from a user perspective) place the printer on the public internet. This allows the server component of the browser application to submit print jobs. Hopefully the user exposes their printer securely - however - considering most people cannot configure a router, it is unlikely that the average person working from home is sharing their printer over the internet securely. This seems worse than exposing CORs to the LAN. There is a little more to this as most users have dynamic ip addresses, but that is ignored for the sake of discussion.
  2. place a reverse proxy in front of CUPs and apply CORs headers there. This method allows the Javascript application running in the browser to print via their local network without exposing the printer over the public internet.

Of the two choices - CORs is safer and simpler for the end user. However there is a large barrier to entry here due to the configuration of a reverse proxy - this really isn't feasible for the average user who just expects printing to work.

Since there are ways to side step the issue - people are doing it. However, since the steps are complicated, it isn't being done well and users are unknowingly creating risk.

Please consider adding CORs support to CUPs in any fashion. It would be very useful to the end users.

Lenguaje dominante
C
Estrellas
1.8k
Forks
331
Merge medio
15 h 28 min
PR fusionados (30 d)
5

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de OpenPrinting/cups

Todos los issues de OpenPrinting/cups

Issues similares

Más issues de C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.