Rename config option `server.enableCORS` to `server.enableCORSProtection`

[cmayoracurzio]

Problem

The name of the config option server.enableCORS is confusing. As mentioned by @snehankekre in this forum post, the real behavior of this option makes it so that a better name would be server.enableCORSProtection.

Solution

Rename config option server.enableCORS to server.enableCORSProtection (and remember to update API Reference docs).

Additional context

This is even marked as "TODO" in the source code, but didn't have a GitHub issue opened until now 😅.

---

Community voting on feature requests enables the Streamlit team to understand which features are most important to our users.

If you'd like the Streamlit team to prioritize this feature request, please use the 👍 (thumbs up emoji) reaction in response to the initial post.

[snehankekre]

cc @kajarenc WDYT? You'd suggested to me that a better name would be server.enableCORSProtection. Should we make the change? Also, will such a change be backwards compatible?

[kajarenc]

@snehankekre based on a quick discussion within the team, this could be done by deprecating the old name and using the new one for the config option.
However, I could not find examples of deprecated options replaced by another name in the current codebase, so we will need to do additional research to make sure of backward compatibility.

as for my opinion, then of course I think it makes sense to rename the config option to more self-explanatory name

[jrieke]

Agree that we should do this. If we do, then we should probably name it server.enableCorsProtection (note the title case) to be aligned with server.enableXsrfProtection.

[jrieke]

I think the way we’d need to go about this:

1. Keep the old config option but remove it from the docs.
2. Show a deprecation warning when using the old config option. Similar to the deprecation warnings for st.cache, they should show up within the app when running locally and in the logs when deployed.
3. Add a config option with the new name and add it to the docs.