eclipse-thingweb / eclipse-thingweb/domus-tdd-api
Invalid CORS Configuration Breaks Browser Clients
Open
- Dominant language
- Python
- Stars
- 7
- Forks
- 9
- PR merge metrics
- No merged PRs in 30d
Description
The API sets Access-Control-Allow-Origin: `localhost`. This is an invalid CORS header value (it must be a full origin like `http://localhost:8080` or `*` )
I would suggest we change the CORS header to Access-Control-Allow-Origin: `*` for public access, or dynamically reflect the Origin header if credentials are required.
what do you think about this @wiresio or what would be the best practice.
Look at also at:
1. https://github.com/sifis-home/wot-serve/issues/20
2. https://github.com/eclipse-thingweb/node-wot/issues/941
Contributor guide
Assessment
This issue has not been assessed yet.