From 75fa39718cfdbdba42151ec0bc8341f3e9f9d182 Mon Sep 17 00:00:00 2001
From: silverpill <silverpill@firemail.cc>
Date: Thu, 10 Feb 2022 23:34:58 +0000
Subject: [PATCH] Add http_cors_allowlist configuration option

---
 src/config.rs | 3 +++
 src/main.rs   | 9 ++++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/config.rs b/src/config.rs
index fcc2892..86cadf2 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -103,6 +103,9 @@ pub struct Config {
     pub http_host: String,
     pub http_port: u32,
 
+    #[serde(default)]
+    pub http_cors_allowlist: Vec<String>,
+
     #[serde(default = "default_log_level")]
     pub log_level: LogLevel,
 
diff --git a/src/main.rs b/src/main.rs
index cb45f01..d5f125e 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -59,9 +59,12 @@ async fn main() -> std::io::Result<()> {
                 Cors::permissive()
             },
             Environment::Production => {
-                let allowed_origin = config.instance_url();
-                Cors::default()
-                    .allowed_origin(&allowed_origin)
+                let mut cors_config = Cors::default();
+                for origin in config.http_cors_allowlist.iter() {
+                    cors_config = cors_config.allowed_origin(&origin);
+                };
+                cors_config
+                    .allowed_origin(&config.instance_url())
                     .allowed_origin_fn(|origin, _req_head| {
                         origin.as_bytes().starts_with(b"http://localhost:")
                     })