apiconsole: allow uploads in console

[jordigh]

By adding an XHR to "Try it out" requests, we can make non-JSON requests pass a CORS check.

[berhalak]

Thanks.

[paulfitz]

Reading the note at

grist-core/app/server/lib/Authorizer.ts

Lines 229 to 237 in a9521a8

	// If we haven't already been authenticated, and this is not a GET/HEAD/OPTIONS, then
	// require a header that would trigger a CORS pre-flight request, either:
	// - X-Requested-With: XMLHttpRequest
	// - https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#use-of-custom-request-headers
	// - https://markitzeroday.com/x-requested-with/cors/2017/06/29/csrf-mitigation-for-ajax-requests.html
	// - Content-Type: application/json
	// - https://www.directdefense.com/csrf-in-the-age-of-json/
	// This is trivial for legitimate web clients to do, and an obstacle to
	// nefarious ones.

I think this is exactly the right solution. Thanks for tracking it down @jordigh !

[dsagal]

Please be sure to verify this works once it reaches staging or prod, since there it's common, I think, to have the window on a URL like https://<org-subdomain>.getgrist.com/apiconsole and the request going to https://api.getgrist.com/....

[jordigh]

I just checked, and it looks like the relevant request, the one initiated by the Swagger API console, does indeed go back to the same origin.

[paulfitz]

^ this is a good point. I just double-checked in prod, and the api console sends requests to the same domain.