Hello,

I am a big enthusiast of REST Service data processing model, Db2 REST Service in particular.

So, I have sucessfully developed a working Java client application to access Db2 REST service on z/OS platform. It is using POST method in http request. Actually, Db2 REST service execute SQL CALL statement to run EXTERNAL Assembler program, using WLM started procedure, which deliver JSON content as a response. It works both using http and https protocol. In my Java client application I set all the basic http headers to make it work. Including Authorisation header set to Basic authorisation. In my testing environment we don't set RACF REST service Db2 profile.

Now, I decided to build a similar application started from the local file web page, in Chrome browser context, using JavaScript script, which would access the same Db2 REST service and render the JSON output.

I use fetch JavaScript statement to connect and fetch content from z/OS Db2 platform, similar to this. 

<font>fetch ("http://mysiteurl:mydb2port/myRESTservice",  {   method: "POST",   body: myPostRequestData,   headers:    {    "Content-type": "application/json; charset=UTF-8", "Accept": "application/json", "Authorization": "Basic " + btoa('user:password'),   },  } )</font>  

It is equivalent to my Java client application accesing Db2 REST service using http protocol.

However, when I run my local file htm web document I receive 

Access to fetch at 'http://mysiteurl:mydb2port/myRESTservice' from origin 'null' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Now, it is quite possible that there is some programming error within my above code...

However, as there is plenty of explanations and remedy on Internet as to how resolve this condition, all of them point to the server side settings. They also propose some unrecommended ways to bypass this condition using PROXY server and some other solutions. 

The explanation for CORS condition goes like "The browser's security mechanism prevents a website from making requests to another website's resources without permission. The most robust solution is to configure the server hosting the requested resource to include the necessary Access-Control-Allow-Origin HTTP header in its responses".

However, my dilemma is how is it possible that the same server responds properly to Java request whereas it rejects JavaScript request? Moreover, there is no any reaction, error message on z/OS side. No SDSF log message, no TCPIP message, no Db2 DIST message when using JavaScript request. Despite Access-Control-Allow-Origin HTTP header in its responses proposal, it all indicates as if my JavaScript request didn't leave Chrome browser context in the first place. OK, maybe Chrome browser sent OPTIONS request first and didn't receive satisfactory response from Db2 server...?

The question is how effective is Chrome browser CORS security mechanism if you can run succesful POST request from Java environment in the first place?

Overall, despite my enthusiasm for Db2 REST Service data processing model, I recognize rather limited Db2 instrumentation for supporting application development exploiting REST model. No trace, no debugging on Db2 side to support poor programmer. Unfortunately, this Db2 deficiency might limit some less enthusiastic application developers from venturing into REST data processing model.

I think, Db2 z/OS by providing REST Service support enters into web server realm, it should provide some configuration mechanism related to the http protocol controls, like setting http headers and possibly other. Also some trace facility of http trafic would be welcomed. I wonder what is the opinion of this subject among Db2 community members?

I wonder if anybody in the community had similar experience with Db2 REST service? I would welcome some discussion related to exploitation of Db2 REST data processing model.

Regards,

Krzysztof Krajewski

www.zSoftwareFactory.com

Good day, Krzystof

I don't have the answer you are looking for, but found this thread very interesting, thanks for sharing.

Let's wait someone could help you on this.

Have a great day!

Hello,

I am a big enthusiast of REST Service data processing model, Db2 REST Service in particular.

So, I have sucessfully developed a working Java client application to access Db2 REST service on z/OS platform. It is using POST method in http request. Actually, Db2 REST service execute SQL CALL statement to run EXTERNAL Assembler program, using WLM started procedure, which deliver JSON content as a response. It works both using http and https protocol. In my Java client application I set all the basic http headers to make it work. Including Authorisation header set to Basic authorisation. In my testing environment we don't set RACF REST service Db2 profile.

Now, I decided to build a similar application started from the local file web page, in Chrome browser context, using JavaScript script, which would access the same Db2 REST service and render the JSON output.

I use fetch JavaScript statement to connect and fetch content from z/OS Db2 platform, similar to this. 

<font>fetch ("http://mysiteurl:mydb2port/myRESTservice",  {   method: "POST",   body: myPostRequestData,   headers:    {    "Content-type": "application/json; charset=UTF-8", "Accept": "application/json", "Authorization": "Basic " + btoa('user:password'),   },  } )</font>  

It is equivalent to my Java client application accesing Db2 REST service using http protocol.

However, when I run my local file htm web document I receive 

Access to fetch at 'http://mysiteurl:mydb2port/myRESTservice' from origin 'null' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Now, it is quite possible that there is some programming error within my above code...

However, as there is plenty of explanations and remedy on Internet as to how resolve this condition, all of them point to the server side settings. They also propose some unrecommended ways to bypass this condition using PROXY server and some other solutions. 

The explanation for CORS condition goes like "The browser's security mechanism prevents a website from making requests to another website's resources without permission. The most robust solution is to configure the server hosting the requested resource to include the necessary Access-Control-Allow-Origin HTTP header in its responses".

However, my dilemma is how is it possible that the same server responds properly to Java request whereas it rejects JavaScript request? Moreover, there is no any reaction, error message on z/OS side. No SDSF log message, no TCPIP message, no Db2 DIST message when using JavaScript request. Despite Access-Control-Allow-Origin HTTP header in its responses proposal, it all indicates as if my JavaScript request didn't leave Chrome browser context in the first place. OK, maybe Chrome browser sent OPTIONS request first and didn't receive satisfactory response from Db2 server...?

The question is how effective is Chrome browser CORS security mechanism if you can run succesful POST request from Java environment in the first place?

Overall, despite my enthusiasm for Db2 REST Service data processing model, I recognize rather limited Db2 instrumentation for supporting application development exploiting REST model. No trace, no debugging on Db2 side to support poor programmer. Unfortunately, this Db2 deficiency might limit some less enthusiastic application developers from venturing into REST data processing model.

I think, Db2 z/OS by providing REST Service support enters into web server realm, it should provide some configuration mechanism related to the http protocol controls, like setting http headers and possibly other. Also some trace facility of http trafic would be welcomed. I wonder what is the opinion of this subject among Db2 community members?

I wonder if anybody in the community had similar experience with Db2 REST service? I would welcome some discussion related to exploitation of Db2 REST data processing model.

Regards,

Krzysztof Krajewski

www.zSoftwareFactory.com

Good day, Krzystof

I don't have the answer you are looking for, but found this thread very interesting, thanks for sharing.

Let's wait someone could help you on this.

Have a great day!

Hello,

I am a big enthusiast of REST Service data processing model, Db2 REST Service in particular.

So, I have sucessfully developed a working Java client application to access Db2 REST service on z/OS platform. It is using POST method in http request. Actually, Db2 REST service execute SQL CALL statement to run EXTERNAL Assembler program, using WLM started procedure, which deliver JSON content as a response. It works both using http and https protocol. In my Java client application I set all the basic http headers to make it work. Including Authorisation header set to Basic authorisation. In my testing environment we don't set RACF REST service Db2 profile.

Now, I decided to build a similar application started from the local file web page, in Chrome browser context, using JavaScript script, which would access the same Db2 REST service and render the JSON output.

I use fetch JavaScript statement to connect and fetch content from z/OS Db2 platform, similar to this. 

<font>fetch ("http://mysiteurl:mydb2port/myRESTservice",  {   method: "POST",   body: myPostRequestData,   headers:    {    "Content-type": "application/json; charset=UTF-8", "Accept": "application/json", "Authorization": "Basic " + btoa('user:password'),   },  } )</font>  

It is equivalent to my Java client application accesing Db2 REST service using http protocol.

However, when I run my local file htm web document I receive 

Access to fetch at 'http://mysiteurl:mydb2port/myRESTservice' from origin 'null' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Now, it is quite possible that there is some programming error within my above code...

However, as there is plenty of explanations and remedy on Internet as to how resolve this condition, all of them point to the server side settings. They also propose some unrecommended ways to bypass this condition using PROXY server and some other solutions. 

The explanation for CORS condition goes like "The browser's security mechanism prevents a website from making requests to another website's resources without permission. The most robust solution is to configure the server hosting the requested resource to include the necessary Access-Control-Allow-Origin HTTP header in its responses".

However, my dilemma is how is it possible that the same server responds properly to Java request whereas it rejects JavaScript request? Moreover, there is no any reaction, error message on z/OS side. No SDSF log message, no TCPIP message, no Db2 DIST message when using JavaScript request. Despite Access-Control-Allow-Origin HTTP header in its responses proposal, it all indicates as if my JavaScript request didn't leave Chrome browser context in the first place. OK, maybe Chrome browser sent OPTIONS request first and didn't receive satisfactory response from Db2 server...?

The question is how effective is Chrome browser CORS security mechanism if you can run succesful POST request from Java environment in the first place?

Overall, despite my enthusiasm for Db2 REST Service data processing model, I recognize rather limited Db2 instrumentation for supporting application development exploiting REST model. No trace, no debugging on Db2 side to support poor programmer. Unfortunately, this Db2 deficiency might limit some less enthusiastic application developers from venturing into REST data processing model.

I think, Db2 z/OS by providing REST Service support enters into web server realm, it should provide some configuration mechanism related to the http protocol controls, like setting http headers and possibly other. Also some trace facility of http trafic would be welcomed. I wonder what is the opinion of this subject among Db2 community members?

I wonder if anybody in the community had similar experience with Db2 REST service? I would welcome some discussion related to exploitation of Db2 REST data processing model.

Regards,

Krzysztof Krajewski

www.zSoftwareFactory.com