Invalid CORS Configuration Breaks Browser Clients

[jona42-ui]

The API sets Access-Control-Allow-Origin: localhost. This is an invalid CORS header value (it must be a full origin like http://localhost:8080 or * )

I would suggest we change the CORS header to Access-Control-Allow-Origin: * for public access, or dynamically reflect the Origin header if credentials are required.

what do you think about this @wiresio or what would be the best practice.

Look at also at:

1. Add a default CORS setting sifis-home/wot-serve#20
2. Let user configure Access-Control-Allow-Origin header node-wot#941

[wiresio]

Do you have a concrete example why this is required? Usually I set up a reverse proxy if I run into such situation.

[jona42-ui]

Do you have a concrete example why this is required? Usually I set up a reverse proxy if I run into such situation.

thanks @wiresio i was looking at purely browser-based apps which could be low priority but it makes sense for the proxy in practice as most counsumers are server-side runtimes.