common/Cors.cc

@@ -6,33 +6,91 @@ namespace visione::cors
 {
 namespace
 {
-std::string allowedOrigin()
+std::vector<std::string> allowedOrigins()
 {
-    return drogon::app()
-        .getCustomConfig()["cors"]
-        .get("allowed_origin", "http://localhost:5173")
-        .asString();
+    auto cfg = drogon::app().getCustomConfig();
+    std::vector<std::string> origins;
+
+    if (cfg.isMember("cors") && cfg["cors"].isObject())
+    {
+        auto &c = cfg["cors"];
+        if (c.isMember("allowed_origin"))
+        {
+            auto &v = c["allowed_origin"];
+            if (v.isArray())
+            {
+                for (const auto &el : v)
+                {
+                    if (el.isString())
+                        origins.emplace_back(el.asString());
+                }
+            }
+            else if (v.isString())
+            {
+                origins.emplace_back(v.asString());
+            }
+        }
+    }
+
+    if (origins.empty())
+        origins.emplace_back("http://localhost:5173");
+
+    return origins;
 }
 
 bool isAllowed(const drogon::HttpRequestPtr &request)
 {
-    return request->getHeader("Origin") == allowedOrigin();
+    auto origin = request->getHeader("Origin");
+    if (origin.empty())
+        return false;
+
+    auto origins = allowedOrigins();
+    for (const auto &o : origins)
+    {
+        if (o == "*" || o == origin)
+            return true;
+    }
+    return false;
 }
 
 void addHeaders(const drogon::HttpRequestPtr &request,
                 const drogon::HttpResponsePtr &response)
 {
-    if (!isAllowed(request))
-    {
+    auto origin = request->getHeader("Origin");
+    if (origin.empty())
         return;
+
+    auto origins = allowedOrigins();
+    bool allowAll = false;
+    bool matched = false;
+    for (const auto &o : origins)
+    {
+        if (o == "*")
+        {
+            allowAll = true;
+            break;
+        }
+        if (o == origin)
+        {
+            matched = true;
+            break;
+        }
     }
 
-    response->addHeader("Access-Control-Allow-Origin", allowedOrigin());
+    if (!allowAll && !matched)
+        return;
+
+    if (allowAll)
+        response->addHeader("Access-Control-Allow-Origin", "*");
+    else
+        response->addHeader("Access-Control-Allow-Origin", origin);
+
     response->addHeader("Access-Control-Allow-Credentials", "true");
     response->addHeader("Access-Control-Allow-Methods",
                         "GET,POST,PATCH,DELETE,OPTIONS");
     response->addHeader("Access-Control-Allow-Headers",
                         "Authorization,Content-Type");
+    response->addHeader("Vary", "Origin");
 }
 }  // namespace
 

config.json

@@ -63,7 +63,7 @@
       "spec_path": "build/openapi/visione.openapi.json"
     },
     "cors": {
-      "allowed_origin": "http://localhost:5173"
+      "allowed_origin": ["http://localhost:3000", "http://localhost:5137"]
     }
   }
-}
+}