fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

jsonrpc: CORS for browser access from multiple sites

Browse source 
[jsonrpc].origins allowlists the websites whose browser JS may call the
stats API cross-site. The request Origin is echoed back only when it is
on the list (never *), OPTIONS preflight is answered with the allowed
method/headers, and Vary: Origin is always set. Non-listed origins get
no allow-origin header, so browsers block them.
This commit is contained in:
Jean Chevronnet 2026-07-13 20:36:22 +00:00
parent 07eb9939d7
commit 92417e7a7c
No known key found for this signature in database
2 changed files with 65 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/config.rs
View file

@ -96,10 +96,15 @@ pub struct ServerTls {
#[derive(Debug, Deserialize, Clone)]
pub struct JsonRpc {
// Address to accept HTTP on, e.g. "127.0.0.1:5601". Keep it on localhost.
// Address to accept HTTP on, e.g. "127.0.0.1:5601". Keep it on localhost and
// let a reverse proxy terminate TLS / HTTP-2 / HTTP-3.
pub bind: String,
// Bearer token every request must present (`authorization: Bearer <token>`).
pub token: String,
// Browser origins allowed to call this cross-site (CORS), e.g.
// ["https://tchatou.fr", "https://swaygo.fr"]. Empty = no browser access.
#[serde(default)]
pub origins: Vec<String>,
}
#[derive(Debug, Deserialize, Clone)]