Add CORS support for debug mode. (#2884)

diff --git a/Cargo.lock b/Cargo.lock
index db4be25efa512e35414c9478219a63c3a8c4d76e..159912e478f5e9c8a4ecf61bc2b41baeb0268c75 100644 (file)
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -102,6 +102,21 @@ dependencies = [
  "tokio-util 0.7.4",
 ]
 
+[[package]]
+name = "actix-cors"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b340e9cfa5b08690aae90fb61beb44e9b06f44fe3d0f93781aaa58cfba86245e"
+dependencies = [
+ "actix-utils",
+ "actix-web",
+ "derive_more",
+ "futures-util",
+ "log",
+ "once_cell",
+ "smallvec",
+]
+
 [[package]]
 name = "actix-form-data"
 version = "0.7.0-beta.0"
@@ -2732,6 +2747,7 @@ version = "0.17.1"
 dependencies = [
  "activitypub_federation",
  "actix",
+ "actix-cors",
  "actix-web",
  "clokwerk",
  "console-subscriber",

diff --git a/Cargo.toml b/Cargo.toml
index ad075f2a23ab76c3a7e3188770689e4e91cb0e4c..344e4646fa4f1e2dcd901ca93127b0ef2823d9a0 100644 (file)
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -141,3 +141,4 @@ console-subscriber = { version = "0.1.8", optional = true }
 opentelemetry-otlp = { version = "0.10.0", optional = true }
 pict-rs = { version = "0.4.0-beta.9", optional = true }
 tokio.workspace = true
+actix-cors = "0.6.4"

diff --git a/src/lib.rs b/src/lib.rs
index 382310b7cba08915c3fc5e43dcd9cce1cf25d870..21a4c25b5d557355a781d39009f6c167b48a3790 100644 (file)
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -8,6 +8,7 @@ pub mod telemetry;
 use crate::{code_migrations::run_advanced_migrations, root_span_builder::QuieterRootSpanBuilder};
 use activitypub_federation::config::{FederationConfig, FederationMiddleware};
 use actix::Actor;
+use actix_cors::Cors;
 use actix_web::{middleware, web::Data, App, HttpServer, Result};
 use doku::json::{AutoComments, CommentsStyle, Formatting, ObjectsStyle};
 use lemmy_api_common::{
@@ -150,8 +151,15 @@ pub async fn start_lemmy_server() -> Result<(), LemmyError> {
       .build()
       .expect("configure federation");
 
+    let cors_config = if cfg!(debug_assertions) {
+      Cors::permissive()
+    } else {
+      Cors::default()
+    };
+
     App::new()
       .wrap(middleware::Logger::default())
+      .wrap(cors_config)
       .wrap(TracingLogger::<QuieterRootSpanBuilder>::new())
       .app_data(Data::new(context))
       .app_data(Data::new(rate_limit_cell.clone()))