Restore allowing CORS, but only in debug mode

DavidMStraub / netviel

Web interface for the notmuch e-mail system

MIT License

54 stars 12 forks source link

Restore allowing CORS, but only in debug mode #6

Closed lmanul closed 4 years ago

lmanul commented 4 years ago

...and print an explicit warning.

lmanul commented 4 years ago

@DavidMStraub @FiloSottile

DavidMStraub commented 4 years ago

Great idea. This should solve the problem discussed in #5 without compromising security in production.

ryneeverett commented 4 years ago

Surely there's no reason to open it up so much. You can limit the origins by host and port.

DavidMStraub commented 4 years ago

Good point @ryneeverett, maybe I was a bit too quick merging it, but at least the development setup works again now...

lmanul commented 4 years ago

Thank you for merging! I can definitely work on restricting this a little more, but I think as long as anyone running this in debug mode is aware of the risk, I think we're clear of the main concern here.