JupyterHub: "Blocking Cross Origin API request"

[dlcrista]

Hi, I was trying to set up istio with jupyterhub so I can use custom envoyfilters through wasm.
However, instead of using the jupyterhub-istio-proxy, I was hoping to keep the configurable-http-proxy (at least until I get this one to work, since I wasn't able to get your proxy to work).

I am using ambassador edge-stack as a reverse proxy. So the system looks like:

[SSL termination via AWS loadbalancer] -> ambassador mapping -> jupyterhub ecosystem from 0.11.1 helm chart...

I have an envoyfilter (using proxy-wasm rust sdk) on the proxy-public pod, and it sets the following request headers:

fn on_http_request_headers(&mut self, num_headers: usize) -> wasm::types::Action {
    let my_host: String = String::from("hub");
    self.set_http_request_header("host", Some(&my_host));
    ...
}

Setting this header in the envoyfilter solves the "No webpage was found for the web address issue" that you document in your medium article. However, now I am getting a new issue. The console shows:

And if I look at the hub pod log, I see:

[W 2021-10-13 22:34:23.091 JupyterHub base:57] Blocking Cross Origin API request.  Referer: https://jupyterhub.something.com/hub/spawn-pending/asdf, Host: hub/hub/

I think it has to do with istio not properly preserving the host header. How do you solve this issue?

[harsimranmaan]

I vaguely recall troubleshooting something similar. I think I had to set something like `c.JupyterHub.ip = "<-public-host-name->" to get this to work. I hope it helps

[dlcrista]

"<-public-host-name->" meaning, the web url that I have jupyterhub, ex: jupyterhub.mydomain.com ? or is it the kubernetes service name? Can you look in your configuration? It would be awesome to have istio working with jupyterhub