-
Notifications
You must be signed in to change notification settings - Fork 140
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
add cors headers #516
base: main
Are you sure you want to change the base?
add cors headers #516
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you for your contribution, Soft Serve uses Gorilla libraries and would prefer to stay that way 🙂
ping @aymanbagabas, should I improve this so you can merge? make all rules "*" perhaps for consistency? |
Hey @fetsorn, I wonder if we can make the CORS origin field configurable. Without that, it can be a security issue for some users. #516 (comment) |
I added three lists to the http section of yaml configuration # The HTTP server configuration.
http:
# The address on which the HTTP server will listen.
listen_addr: ":23232"
allowed_headers:
- Content-Type
- X-Requested-With
allowed_origins:
- *
allowed_methods:
- GET
- HEAD
- POST |
This looks good @fetsorn! I would move the config to |
I brought out the "cors" configuration struct. I believe that "allowed_headers" is more correct than just "headers" because it corresponds to gorilla's variable`handlers.AllowedHeaders" and the preflight header Access-Control-Allow-Headers. |
@aymanbagabas What can I improve to bring this closer to merge? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please use gofumpt
to format your code 🙂
Hey @fetsorn, could you rebase the PR and any lint issues? This will be released in v0.8.0 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Would be nice to have tests for this, otherwise, LGTM
pkg/config/config.go
Outdated
fmt.Sprintf("SOFT_SERVE_HTTP_CORS_ALLOWED_HEADERS=%s", strings.Join(c.HTTP.CORS.AllowedHeaders, "\n")), | ||
fmt.Sprintf("SOFT_SERVE_HTTP_CORS_ALLOWED_ORIGINS=%s", strings.Join(c.HTTP.CORS.AllowedOrigins, "\n")), | ||
fmt.Sprintf("SOFT_SERVE_HTTP_CORS_ALLOWED_METHODS=%s", strings.Join(c.HTTP.CORS.AllowedMethods, "\n")), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
caarlos0/env
by default separate lists by commas
fmt.Sprintf("SOFT_SERVE_HTTP_CORS_ALLOWED_HEADERS=%s", strings.Join(c.HTTP.CORS.AllowedHeaders, "\n")), | |
fmt.Sprintf("SOFT_SERVE_HTTP_CORS_ALLOWED_ORIGINS=%s", strings.Join(c.HTTP.CORS.AllowedOrigins, "\n")), | |
fmt.Sprintf("SOFT_SERVE_HTTP_CORS_ALLOWED_METHODS=%s", strings.Join(c.HTTP.CORS.AllowedMethods, "\n")), | |
fmt.Sprintf("SOFT_SERVE_HTTP_CORS_ALLOWED_HEADERS=%s", strings.Join(c.HTTP.CORS.AllowedHeaders, ",")), | |
fmt.Sprintf("SOFT_SERVE_HTTP_CORS_ALLOWED_ORIGINS=%s", strings.Join(c.HTTP.CORS.AllowedOrigins, ",")), | |
fmt.Sprintf("SOFT_SERVE_HTTP_CORS_ALLOWED_METHODS=%s", strings.Join(c.HTTP.CORS.AllowedMethods, ",")), |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #516 +/- ##
==========================================
+ Coverage 51.96% 53.05% +1.09%
==========================================
Files 157 159 +2
Lines 13454 11561 -1893
==========================================
- Hits 6991 6134 -857
+ Misses 5891 4859 -1032
+ Partials 572 568 -4 ☔ View full report in Codecov by Sentry. |
@fetsorn I'm preparing the release notes for the next release, do you think you can add test cases for this feature to be included in the next release? |
What tests cases do you imagine would be required? Should I add them to https://github.com/charmbracelet/soft-serve/blob/main/testscript/testdata/http.txtar? |
Yes, or you could add them to a new |
What's the window of time until the release? |
Ideally in the next couple of weeks |
@fetsorn I'm planning on pushing a new release soon. It would be nice to have this PR included in the next release 🙂 |
I needed to clone a soft-serve repo from the browser so I added cors headers.