iotaledger / hornet

HORNET is a powerful IOTA fullnode software
Apache License 2.0
310 stars 151 forks source link

CORS header 'Access-Control-Allow-Origin' missing #1900

Closed EddyTheCo closed 1 year ago

EddyTheCo commented 1 year ago

Is your feature request related to a problem? Please describe. When using a browser client application to make a request to the REST API , the API request could be denied with the return 'Reason: CORS header 'Access-Control-Allow-Origin' missing'. In that case, one needs to set the Access-Control-Allow-Origin header's value(on the node server) as explained here. This is important for web3 applications that communicate directly with the node.

Describe the solution you'd like I would like to be possible to set the 'Access-Control-Allow-Origin' of traefik in the default configuration of hornet. This can be done by adding

- "traefik.http.middlewares.cors.headers.customResponseHeaders.Access-Control-Allow-Origin=*"
- "traefik.http.routers.hornet.middlewares=cors"

to the docker-compose.yml in the traefik section.

Describe alternatives you've considered One could also add an explanation of this on the wiki.

muXxer commented 1 year ago

I don't understand your request. There is no traefik in hornet. Maybe you are talking about the https://github.com/iotaledger/node-docker-setup repository?

But there you can easily modify the docker-compose file yourself to add these tags.

Anyway, in hornet we have a CORS middleware activated for the REST API with the following defaults:


    // DefaultCORSConfig is the default CORS middleware config.
    DefaultCORSConfig = CORSConfig{
        Skipper:      DefaultSkipper,
        AllowOrigins: []string{"*"},
        AllowMethods: []string{http.MethodGet, http.MethodHead, http.MethodPut, http.MethodPatch, http.MethodPost, http.MethodDelete},
    }```