search

janelia-flyem / dvid

Distributed, Versioned, Image-oriented Dataservice
http://dvid.io
Other
197 stars 33 forks source link

Maximally permissive CORS by default #362

Closed stuarteberg closed 4 months ago

stuarteberg commented 2 years ago

Is there any reason at all not to enable CORS by default, always?

I know we can configure permissive CORS access in the TOML file:

corsDomains = ["*"]

...but sometimes we forget to do that. I am too afraid to even try to estimate how many developer hours of debug time we've lost due to CORS issues over the years. As far as I can tell, there is nothing in DVID presents a security concern that would be helped by restrictive CORS headers. Make it permissive by default, but allow us to lock it down in the TOML if we really want to.

DocSavage commented 2 years ago

Yes, if CORS is enabled by default any DVID fronted by nginx, which is a fairly common, would break because nginx would also be handling CORS and we'll get issues. We could add a flag to "dvid serve" that allows shutting off any cors handling, and make sure all current nginx front DVID servers that get code updates start using that -noCORS flag.

DocSavage commented 4 months ago

Given roadmap for DVID usage and legacy systems, this seems like an unnecessary enhancement.