Neo4j: connect to localhost:7474/ REST API from JavaScript in Ubuntu 16.04

Question

For a Chrome extension project, I am creating a bare-bones HTML + JavaScript page to test the REST API for Neo4j. I have Neo4j Community Edition 3.0.6 running at http://localhost:7474/ and can connect to the /browser page. I am developing on Ubuntu 16.04

When I connect from a page at localhost/ , I get the error:

XMLHttpRequest cannot load http://localhost:7474/db/data/ . No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin ' http://localhost ' is therefore not allowed access. The response had HTTP status code 401.
Error: 0(…)

I understand that I need to set up Apache2 on Ubuntu 16.04 to allow port 7474 to include an 'Access-Control-Allow-Origin' header of "*".

I have added the following lines to /etc/apache2/apache2.conf and restarted the server, but I'm still seeing the error:

LoadModule headers_module /usr/lib/apache2/modules/mod_headers.so
Header always set Access-Control-Allow-Origin "*"

What more or what else do I need to do?

Answer 1

The issue appears that you're misunderstanding how to enable the CORS correctly. The header is meant to be set on the Neo4J webservice to denote to the browser that when content from localhost:80 makes a request to localhost:7474, the response (from :7474) is allowed to be consumed.

You're current setup means that if anything in the neo4j browser pages (on port 7474) makes a request to localhost:80, then the browser will allow it (so the opposite way around to what you're after).

See these explanations for more details:

• https://www.eriwen.com/javascript/how-to-cors/
• https://staticapps.org/articles/cross-domain-requests-with-cors/
• How does Access-Control-Allow-Origin header work?

I'm not sure how easy it is to amend the Neo4j server headers that come back, so I imagine what you want is to do is proxy (via your Apache server) traffic to port 7474, thus side stepping CORS as everything will be going to port 80. How that helps you for your chrome extension, i'm not sure (sorry)