Serverless design

[msessa]

Reading through the server-side node app source code it looks like most of the routes are simply proxying the client request to the vault server with no further modifications.

Given a scenario where the vault server is exposed directly to clients via a reverse proxy (nginx or such) adding the Access-Control-Allow-Origin: * header, it could be possible to adapt vault-ui react code to speak directly to the vault server without the need for the node server-side component.
This enables scenarios such as deploying to S3 static sites.

Is it something you guys would be interested in further exploring?

[djenriquez]

Yes, @msessa-cotd, in fact, this was actually our original design. The problem with this though was that Vault did not have the ability to manage CORS. Such a design dependened on a reverse proxy to add in headers. Since the dependency took it outside of Vault, we decided to implement Vault-UI the way it is today.

Really, we'd love to simplify it as much as possible, but "out-of-the-box" use-case is more important to us than simplification. If/when HashiCorp decides to add the feature for CORs, we can revisit this. You can follow the feature request here: hashicorp/vault#796

[msessa]

I might attempt something in a branch where I reduce the nodejs component to nothing but a reverse proxy and change all the react code AJAX calls to the original vault API specs.
If this effort proves successful it would make things easier when and if vault implements CORS headers.

[msessa]

Upcoming v1.1.0 removes all remaining logic from the node/express code.

CORS support in Vault has been scheduled for v0.7.0. Once it's released we can start planning the phasing out of the server side nodejs component.

For now I'll just close this issue.

[PhillippOhlandt]

@msessa seems like vault 0.7.0 still has no support for CORS, or did I miss something?

[msessa]

You are correct. New milestone is 0.7.1

[msessa]

We're devising some strategies to work around the problem in the meantime

[PhillippOhlandt]

@msessa I am building my own client at the moment. I used nginx as a workaround.

[msessa]

this issue has been addressed in #85 by making vault-ui a client-side desktop app