Safe CORS configuration

[johan-bjareholt]

rocket_cors now support regex in the origin configuration, we should use that to implement CORS safely. Maybe also add support for custom origin configurations in the config?

[ErikBjare]

Some bad news: In Firefox, extensions do not use their ID in the extension URL, they use an installation-unique extension UUID (apparently to prevent fingerprinting).

They mention it here: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/web_accessible_resources

---

---

This means we have to use a moz-extension://* origin for Firefox users, this is not ideal as it would let any Firefox extension access the ActivityWatch database.

Seems we have yet another reason to start working on a proper authentication flow.