Apache CORS Headers

It is possible to add multiple domains by using the following:

Header set Access-Control-Allow-Origin "http://domain1.com"
Header add Access-Control-Allow-Origin "http://domain2.net"
Header add Access-Control-Allow-Origin "http://domain3.org"

However, it doesn't work entirely as expected and it also exposes all your API clients to anyone interested. Not a big deal, but why expose more info than necessary?

So, to only have valid requests return one single domain (the accepted Origin) we can configure Apache to dynamically check and return only one permitted domain:

SetEnvIf Origin "(http|https)://(domain1.com|domain2.net|domain3.org)$" RequestOrigin=$0
Header always set Access-Control-Allow-Origin %{RequestOrigin}e env=RequestOrigin

This will return http://domain2.net if the request has an Origin of http://domain2.net. If the request has an origin that isn't matched by the regular expression in the SetEnvIf command, then it will not return any Access-Control-Allow-Origin header at all!

Some other headers I always include:

Header set Access-Control-Allow-Methods 'GET,PUT,POST,DELETE,OPTIONS'
Header set Access-Control-Allow-Credentials true

OpenVPN on Windows 7

I have always had a problem with OpenVPN on my Windows 7 (64 bit, pro edition) laptop. Installing would go just fine, but it was never able to connect to the VPN server, even though I checked on several other computers (even a Windows 7 one) that the settings were correct and working.

VirtualBox
As it turns out, OpenVPN and Oracle VirtualBox on the same computer just doesn't work. Uninstalling VirtualBox would make it possible to connect to my VPN server.

However, I then encountered another issue...

TUN/TAP Driver
If the VPN connection dropped, like due to an unstable wifi link, I could never get it to work after it had reconnected.

After rebooting it would work fine though, so after a bit of fiddling I came up with a workaround. Before reconnecting to the VPN server I have to disable and then re-enable the TUN/TAP network driver. Go figure...

Software Used

• Windows 7 64 bit professional edition
• VirtualBox 4.0.10 and 4.1.0
• OpenVPN 2.2.1

Ubuntu and OpenVPN FQDN Problems.

I have been having some weird problems with OpenVPN on my clean Ubuntu 10.10 (desktop) install whenever I connect to a remote LAN using OpenVPN. The remote LAN hosts a number of servers, all located under the domain company.local (example). Even if it connects and I can ping the remote machine that is called testserver, I can NOT ping the same server through its fully qualified domain name (FQDN) testserver.company.local. Ping would fail with the following error:

ping: unknown host testserver.company.local

Trying to lookup the FQDN with nslookup works just fine! Strange!

Now it appears that the reason is something called a MDNS (Multicast DNS) which kicks in and handles (by default) all .local domains. Looking at the file /etc/nsswitch.conf I found a line that looks like this:

hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4

Apparently the '.local' extension is not sent to the DNS server for resolution if the MDNS system cant resolve it. So I went ahead and changed the line to:

hosts: files mdns4_minimal dns mdns4

I went back to the shell and ran ping testserver.company.local again, and lo-and-behold it works!

Software used:

• NetworkManager
• NetworkManager-OpenVPN
• OpenVPN
• Ubuntu 10.10 Desktop