Missing CORS prevents third-party web clients

diamond (she/they)@beehaw.org to Beehaw Support@beehaw.org – 6 points –

Hey Beehaw mods!

I'm currently working on a Lemmy web client, but the lack of proper CORS headers is preventing anything from working :(

I just wanted to ask if the appropriate CORS headers could be added to the front-facing proxy layer. If you're using Caddy, I believe something like this should do the trick:

reverse_proxy ... {
  header_down Access-Control-Allow-Origin *
  header_down Access-Control-Allow-Methods *
  header_down Access-Control-Allow-Headers *
}

Relevant issue: https://github.com/LemmyNet/lemmy/issues/3109

10

You are viewing a single comment

Websocket handshakes are done over HTTP. The endpoint for Beehaw's WS API would be wss://beehaw.org/, so it's still going to use the same CORS policies as accessing the / (root) path.

4 more...