alice.pds.demo.boltless.dev
This repository has no description
spindle/xrpc: allow cross-origin requests from the web frontend
The web app calls the spindle's service-auth'd xrpc directly to manage repo
secrets; add a wildcard CORS middleware (auth is bearer-token, not cookie-based,
so * is safe), mirroring the appview.
Signed-off-by: Anirudh Oppiliappan <anirudh@tangled.org>
author
Anirudh Oppiliappan
date
(Aug 4, 2026, 5:06 PM +0300)
commit
5509aa8f
5509aa8f61fdeba7ab0710c3134d2518e80f28ac
parent
6c182913
6c1829135f2be288c8f39d7246d8f8ab3acd00f9
change-id
uupsykuw
uupsykuwlvvpolkprzkyurkykzwrmwll
+17
+17
spindle/xrpc/xrpc.go
+17
spindle/xrpc/xrpc.go
···
55
55
56
56
func (x *Xrpc) Router() http.Handler {
57
57
r := chi.NewRouter()
58
+
r.Use(x.cors)
58
59
59
60
r.Group(func(r chi.Router) {
60
61
r.Use(x.ServiceAuth.VerifyServiceAuth)
···
73
74
r.Get("/"+tangled.CiGetPipelineNSID, x.HandleCiGetPipeline)
74
75
75
76
return r
77
+
}
78
+
79
+
// cors allows the browser origin to call these xrpc endpoints directly. auth is
80
+
// via service-auth bearer tokens, not cookies, so a wildcard origin is safe.
81
+
func (x *Xrpc) cors(next http.Handler) http.Handler {
82
+
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
83
+
w.Header().Set("Access-Control-Allow-Origin", "*")
84
+
w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
85
+
w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
86
+
w.Header().Set("Access-Control-Max-Age", "86400")
87
+
if r.Method == http.MethodOptions {
88
+
w.WriteHeader(http.StatusNoContent)
89
+
return
90
+
}
91
+
next.ServeHTTP(w, r)
92
+
})
76
93
}
77
94
78
95
// this is slightly different from http_util::write_error to follow the spec: