From c94d22591b7ea913e38b2112fc9202c4f2edfa6e Mon Sep 17 00:00:00 2001
From: Pavlo Golub <pavlo.golub@gmail.com>
Date: Thu, 2 May 2024 15:45:05 +0200
Subject: [PATCH] [+] allow CORS from `http://localhost:4000` for webui
 debugging (#439)

---
 src/webserver/cors.go      | 18 ++++++++++++++++++
 src/webserver/webserver.go |  2 +-
 2 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 src/webserver/cors.go

diff --git a/src/webserver/cors.go b/src/webserver/cors.go
new file mode 100644
index 0000000000..585b0671a4
--- /dev/null
+++ b/src/webserver/cors.go
@@ -0,0 +1,18 @@
+package webserver
+
+import (
+	"net/http"
+)
+
+func corsMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Access-Control-Allow-Origin", "http://localhost:4000") //check src/webui/.env
+		w.Header().Set("Access-Control-Allow-Methods", "POST, GET, OPTIONS, PUT, DELETE")
+		w.Header().Set("Access-Control-Allow-Headers", "Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, token")
+		if r.Method == "OPTIONS" {
+			w.WriteHeader(http.StatusOK)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
diff --git a/src/webserver/webserver.go b/src/webserver/webserver.go
index dd34d91457..9c28aa2fc8 100644
--- a/src/webserver/webserver.go
+++ b/src/webserver/webserver.go
@@ -36,7 +36,7 @@ func Init(opts config.WebUIOpts, webuifs fs.FS, mrw metrics.ReaderWriter, srw so
 			ReadTimeout:    10 * time.Second,
 			WriteTimeout:   10 * time.Second,
 			MaxHeaderBytes: 1 << 20,
-			Handler:        mux,
+			Handler:        corsMiddleware(mux),
 		},
 		opts,
 		webuifs,