First a disclaimer: I’m quite a newbie in OHIF but I’m one of the Orthanc maintainer. I’m trying to integrate OHIF with Orthanc in order to grant access to a single study (or clearly identified multiple studies).
We have everything we need in Orthanc to grant access to a single study based on a token - the first challenge here is to configure OHIF (v3-stable) such that it includes this token in every HTTP request to orthanc. We have already done this for other more Orthanc centric viewers (like the Stone Web Viewer).
Typically, I’d like to open OHIF with this kind of url:
http://localhost/viewer?StudyInstanceUIDS=1.2.3&token=my-token and have an HTTP Header
"token": "my-token" included in every request.
What I’ve tried so far:
- I played with the
requestOptionsconfiguration (I could generate a config file dynamically if needed) but I could not even make it work with basic auth. Is there a full sample available to demonstrate how to use
requestOptionspossibly with Orthanc ?
- I modified OHIF to take this token from the URL arguments: it worked partially but, some requests are sent from the cornerstone-wado-image-loader and I did not want to start modifying dependencies
- I made a small redirect page that adds the token in the cookies and a reverse proxy that reads the token from cookie to add it back to the headers.
This last attempt is working in terms of the token being received by Orthanc. However, I’m encountering another problem: OHIF makes a QIDO-RS call to list studies based on the PatientID (
Since my token grants access to a single study, my authorization layer forbids this call that could return data from other patients whose PatientID would match the
Therefore OHIF receives a 403. One of the impact is that the series thumbnail is not displayed in this case !
Hence my last question: is there a way to:
- prevent OHIF to perform that QIDO-RS query that seems to search for prior studies
- make OHIF more strict and look for exact match of the PatientID (in this case, I could use tokens that would grant access to a full patient and not a single study)
Thanks a lot for your help, that would help both communities a lot !