Cors policy should allow any origin by default (fixes #5405) (#5406)

This commit is contained in:
Nutomic 2025-02-07 16:11:44 +00:00 committed by GitHub
parent ba7d4bd117
commit b92853824f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -15,7 +15,10 @@ pub fn cors_config(settings: &Settings) -> Cors {
.expose_any_header()
.max_age(3600);
if cfg!(debug_assertions) || cors_origin_setting.contains(&"*".to_string()) {
if cfg!(debug_assertions)
|| cors_origin_setting.is_empty()
|| cors_origin_setting.contains(&"*".to_string())
{
cors = cors.allow_any_origin();
} else {
cors = cors.allowed_origin(&self_origin);