CORS Error in Graph Explorer when using SSH Tunnel

[outcomes-winter-niteshjain]

I am using Neptune through a SSH tunnel and does not have IAM enabled. When I use graph explorer, I get CORS error, any solution to that?

[outcomes-winter-niteshjain]

Reference: #127 (comment)

[kmcginnes]

Thanks for moving this to a discussion.

Do you have the proxy server enabled on the connection? Even though you don't use IAM that might be required for Neptune to work.

Also, when I access Neptune using SSH I have to modify my hosts file to ensure the traffic flows. Do you have that setup? If you need me to I can try to find the setup instructions.

[outcomes-winter-niteshjain]

I tried creating a nodejs proxy server but that didn't work.
What kind of proxy server you are referring?

And, I don't have hosts setup as I am able to access Neptune via SSH, it just that, it is not working in graph-explorer and throwing CORS error.

[kmcginnes]

The proxy server is what we call the server that is hosting the Graph Explorer website files. It serves as a proxy to sign query requests for Neptune IAM. You don't need that, but I believe the server does use slightly different request headers compared to queries executed directly from the browser.

In general, the URL to the proxy server is similar to the URL for accessing the front end. So if your front end is running on:

http://localhost/explorer/

Then the proxy server URL would be:

http://localhost

[outcomes-winter-niteshjain]

I am getting below error.

Network Response 500
request to https://host.docker.internal:8182/gremlin failed, reason: Hostname/IP does not match certificate's altnames: Host: host.docker.internal. is not in the cert's altnames: DNS:*.cp0sdgsecgbd.us-east-1.neptune.amazonaws.com, DNS:*.cluster-custom-cp0sdgsecgbd.us-east-1.neptune.amazonaws.com, DNS:*.cluster-ro-cp0sdgsecgbd.us-east-1.neptune.amazonaws.com, DNS:*.cluster-cp0sdgsecgbd.us-east-1.neptune.amazonaws.com

I believe, I can't directly use neptune's address as it is in private VPC. So I did SSH tunneling, and ran graph-explorer in a docker.

[kmcginnes]

The Graph Explorer server running inside the Docker container can't access the SSH tunnel on your host machine. The SSH tunnel and host file edits would need to happen within the Docker container, which is a tall order. There might be a way to share the host networking with the container using whatever Docker runtime you are using. That might work, but I have not tested it.

Any time I use SSH tunneling for Neptune access I am running Graph Explorer locally with Node (typically in DEV mode, but I don't think that is important). You could try running Graph Explorer locally (without Docker) if you want to pursue the SSH tunneling path.

However, the simplest path to using Graph Explorer with Neptune is to create a Neptune Notebook. Graph Explorer will be setup and configured for you, automatically, all within the VPC.

[outcomes-winter-niteshjain]

Okay, I will use it with node.

[outcomes-winter-niteshjain]

Steps to connect Amazon Neptune (private VPC access via SSH tunnel) to Neptune Graph Explorer running in Docker on macOS:

1. Start an SSH tunnel from your Mac to the Neptune cluster through the bastion host:

ssh -N \
  -i <key.pem> \
  -L 8182:<neptune-host.cluster.neptune.amazonaws.com>:8182 \
  ec2-user@<bastion-host>

Verify the tunnel:

curl -k https://localhost:8182/status

Expected response: Neptune status JSON.

2. Run Neptune Graph Explorer Docker container:

docker run -d \
  --platform linux/amd64 \
  --name neptune-graph-explorer \
  -p 8888:80 \
  --add-host=<neptune-host.cluster.neptune.amazonaws.com>:host-gateway \
  public.ecr.aws/neptune/graph-explorer:latest

Why --add-host is needed:

• Neptune TLS certificate is issued for the Neptune hostname.
• Connecting via localhost or host.docker.internal causes TLS hostname validation failure.
• Mapping the Neptune hostname to Docker host gateway preserves the hostname while routing traffic through the local SSH tunnel.

3. Open Graph Explorer:

http://localhost:8888/explorer

4. Configure Graph Explorer connection:

• Query Language: Gremlin - PG
• Using Proxy Server: Enabled
• Public / Proxy Endpoint:

http://localhost:8888

• Graph Connection URL:

https://<neptune-host.cluster.neptune.amazonaws.com>:8182

5. Connect.