CORS + Cookies flags

api/api.go

@@ -50,6 +50,8 @@ func New(
 	enableReqLogger bool,
 	enableMetrics bool,
 	logsLimit uint64,
+	allowedCredsEnabled bool,
+	allowedOriginEnabled bool,
 ) (http.HandlerFunc, func()) {
 	origins := strings.Split(strings.TrimSpace(allowedOrigins), ",")
 	for i, o := range origins {
@@ -102,11 +104,24 @@ func New(
 	}
 
 	handler := handlers.CompressHandler(router)
-	handler = handlers.CORS(
+	corsOptions := []handlers.CORSOption{
 		handlers.AllowedOrigins(origins),
 		handlers.AllowedHeaders([]string{"content-type", "x-genesis-id"}),
 		handlers.ExposedHeaders([]string{"x-genesis-id", "x-thorest-ver"}),
-	)(handler)
+	}
+
+	if allowedCredsEnabled {
+		corsOptions = append(corsOptions, handlers.AllowCredentials())
+	}
+
+	if allowedOriginEnabled {
+		corsOptions = append(corsOptions, handlers.AllowedOriginValidator(func(origin string) bool {
+			// Allow all origins by always returning true
+			return true
+		}))
+	}
+
+	handler = handlers.CORS(corsOptions...)(handler)
 
 	if enableReqLogger {
 		handler = RequestLoggerHandler(handler, log)

cmd/thor/flags.go

@@ -69,6 +69,14 @@ var (
 		Value: 1000,
 		Usage: "limit the number of logs returned by /logs API",
 	}
+	apiAllowedCredsFlag = cli.BoolFlag{
+		Name:  "api-allowed-creds",
+		Usage: "enables Access-Control-Allow-Credentials header in API response",
+	}
+	apiAllowedOriginsFlag = cli.BoolFlag{
+		Name:  "api-allowed-origins",
+		Usage: "enables Access-Control-Allow-Origin to be set as the Origin request",
+	}
 	enableAPILogsFlag = cli.BoolFlag{
 		Name:  "enable-api-logs",
 		Usage: "enables API requests logging",

cmd/thor/main.go

@@ -82,6 +82,8 @@ func main() {
 			apiAllowCustomTracerFlag,
 			enableAPILogsFlag,
 			apiLogsLimitFlag,
+			apiAllowedCredsFlag,
+			apiAllowedOriginsFlag,
 			verbosityFlag,
 			maxPeersFlag,
 			p2pPortFlag,
@@ -112,6 +114,8 @@ func main() {
 					apiAllowCustomTracerFlag,
 					enableAPILogsFlag,
 					apiLogsLimitFlag,
+					apiAllowedCredsFlag,
+					apiAllowedOriginsFlag,
 					onDemandFlag,
 					blockInterval,
 					persistFlag,
@@ -242,6 +246,8 @@ func defaultAction(ctx *cli.Context) error {
 		ctx.Bool(enableAPILogsFlag.Name),
 		ctx.Bool(enableMetricsFlag.Name),
 		ctx.Uint64(apiLogsLimitFlag.Name),
+		ctx.Bool(apiAllowedCredsFlag.Name),
+		ctx.Bool(apiAllowedOriginsFlag.Name),
 	)
 	defer func() { log.Info("closing API..."); apiCloser() }()
 
@@ -381,6 +387,8 @@ func soloAction(ctx *cli.Context) error {
 		ctx.Bool(enableAPILogsFlag.Name),
 		ctx.Bool(enableMetricsFlag.Name),
 		ctx.Uint64(apiLogsLimitFlag.Name),
+		ctx.Bool(apiAllowedCredsFlag.Name),
+		ctx.Bool(apiAllowedOriginsFlag.Name),
 	)
 	defer func() { log.Info("closing API..."); apiCloser() }()