Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Turn on CORS #155

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Turn on CORS #155

wants to merge 4 commits into from

Conversation

FossPrime
Copy link

Most browsers won't allow connections over the "Internet" when CORS is not configured. This is a problem in Glitch, AWS, GCP, CodeSandbox and other setups where HTTPS encryption is handled by a transparent reverse proxy. Usually nginx, tiny, Apache Mod-proxy, Route 53 or Google Load Balancer.

FossPrime and others added 3 commits June 3, 2021 00:37
Most browsers won't allow connections over the "Internet" when CORS is not configured. This is a problem in Glitch, AWS, GCP, CodeSandbox and other setups where HTTPS encryption is handled by a transparent reverse proxy. Usually nginx, tiny, Apache Mod-proxy, Route 53 or Google Load Balancer.
@napcs
Copy link
Owner

napcs commented Jun 23, 2021

@rayfoss this is a good idea if it's required, but I have a couple thoughts here.

First, I feel this should be opt-in, which means options for the server and the CLI implementation.
Second, are the POST and OPTIONS methods really necessary for the allowlist?
Finally, should we split out the CORS headers from the others and merge the header objects?

Also, I am about to flip this over to standard JS to get rid of the CoffeeScript requirement. I just haven't done the release. How urgent is this for you?

@FossPrime
Copy link
Author

FossPrime commented Jun 25, 2021

It's not urgent for me at all.

I recall only the GET request is needs it... good point.

This is almost exclusively used for local development, DDOS isn't a huge concern, but I lean towards production ready defaults... so I'm leaning towards a super simple option.

Test tools:

@thgh
Copy link

thgh commented Aug 2, 2021

If this is merged, thgh/rollup-plugin-livereload#66 will make use of it.

@galoko
Copy link

galoko commented Jun 24, 2022

If this is merged, thgh/rollup-plugin-livereload#66 will make use of it.

Looks like it's still not released for some reason. Also I don't see how this patch allows to extend this to support COEP.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants