support multiple CORS origins (#5150)

Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com>
This commit is contained in:
KHuynh 2025-11-21 02:00:46 +01:00 committed by GitHub
parent 14ab95f39c
commit ade0cddeb3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
24 changed files with 441 additions and 180 deletions

View file

@ -76,7 +76,7 @@ type httpServer struct {
encryption bool
serverKey string
serverCert string
allowOrigin string
allowOrigins []string
trustedProxies conf.IPNetworks
readTimeout conf.Duration
writeTimeout conf.Duration
@ -90,12 +90,13 @@ func (s *httpServer) initialize() error {
router := gin.New()
router.SetTrustedProxies(s.trustedProxies.ToTrustedProxies()) //nolint:errcheck
router.Use(s.middlewareOrigin)
router.Use(s.middlewarePreflightRequests)
router.Use(s.onRequest)
s.inner = &httpp.Server{
Address: s.address,
AllowOrigins: s.allowOrigins,
ReadTimeout: time.Duration(s.readTimeout),
WriteTimeout: time.Duration(s.writeTimeout),
Encryption: s.encryption,
@ -319,11 +320,7 @@ func (s *httpServer) onPage(ctx *gin.Context, pathName string, publish bool) {
}
}
func (s *httpServer) middlewareOrigin(ctx *gin.Context) {
ctx.Header("Access-Control-Allow-Origin", s.allowOrigin)
ctx.Header("Access-Control-Allow-Credentials", "true")
// preflight requests
func (s *httpServer) middlewarePreflightRequests(ctx *gin.Context) {
if ctx.Request.Method == http.MethodOptions &&
ctx.Request.Header.Get("Access-Control-Request-Method") != "" {
ctx.Header("Access-Control-Allow-Methods", "OPTIONS, GET, POST, PATCH, DELETE")