Make CORS option configurable #2812

3 files changed, 40 insertions, 7 deletions

diff --git a/conf/glances.conf b/conf/glances.conf
index 83f0dac3..30931fc1 100644
--- a/conf/glances.conf
+++ b/conf/glances.conf
@@ -23,12 +23,16 @@ history_size=1200
 ##############################################################################
 
 [outputs]
+# Options for all UIs
+#--------------------
 # Separator in the Curses and WebUI interface (between top and others plugins)
 separator=True
 # Set the the Curses and WebUI interface left menu plugin list (comma-separated)
 #left_menu=network,wifi,connections,ports,diskio,fs,irq,folders,raid,smart,sensors,now
 # Limit the number of processes to display (in the WebUI)
 max_processes_display=25
+# Options for WebUI
+#------------------
 # Set URL prefix for the WebUI and the API
 # Example: url_prefix=/glances/ => http://localhost/glances/
 # Note: The final / is mandatory
@@ -41,9 +45,22 @@ max_processes_display=25
 # then configure this folder with the webui_root_path key
 # Default is folder where glances_restfull_api.py is hosted
 #webui_root_path=
+# CORS options
+# Comma separated list of origins that should be permitted to make cross-origin requests.
+# Default is *
+#cors_origins=*
+# Indicate that cookies should be supported for cross-origin requests.
+# Default is True
+#cors_credentials=True
+# Comma separated list of HTTP methods that should be allowed for cross-origin requests.
+# Default is *
+#cors_methods=*
+# Comma separated list of HTTP request headers that should be supported for cross-origin requests.
+# Default is *
+#cors_headers=*
 
 ##############################################################################
-# plugins
+# Plugins
 ##############################################################################
 
 [quicklook]
diff --git a/docker-compose/glances.conf b/docker-compose/glances.conf
index 0686b528..3d073744 100755
--- a/docker-compose/glances.conf
+++ b/docker-compose/glances.conf
@@ -23,12 +23,16 @@ history_size=1200
 ##############################################################################
 
 [outputs]
+# Options for all UIs
+#--------------------
 # Separator in the Curses and WebUI interface (between top and others plugins)
 separator=True
 # Set the the Curses and WebUI interface left menu plugin list (comma-separated)
 #left_menu=network,wifi,connections,ports,diskio,fs,irq,folders,raid,smart,sensors,now
 # Limit the number of processes to display (in the WebUI)
 max_processes_display=25
+# Options for WebUI
+#------------------
 # Set URL prefix for the WebUI and the API
 # Example: url_prefix=/glances/ => http://localhost/glances/
 # Note: The final / is mandatory
@@ -41,6 +45,19 @@ max_processes_display=25
 # then configure this folder with the webui_root_path key
 # Default is folder where glances_restfull_api.py is hosted
 #webui_root_path=
+# CORS options
+# Comma separated list of origins that should be permitted to make cross-origin requests.
+# Default is *
+#cors_origins=*
+# Indicate that cookies should be supported for cross-origin requests.
+# Default is True
+#cors_credentials=True
+# Comma separated list of HTTP methods that should be allowed for cross-origin requests.
+# Default is *
+#cors_methods=*
+# Comma separated list of HTTP request headers that should be supported for cross-origin requests.
+# Default is *
+#cors_headers=*
 
 ##############################################################################
 # plugins
diff --git a/glances/outputs/glances_restful_api.py b/glances/outputs/glances_restful_api.py
index 934a6531..61f5fa9d 100644
--- a/glances/outputs/glances_restful_api.py
+++ b/glances/outputs/glances_restful_api.py
@@ -130,12 +130,11 @@ class GlancesRestfulApi:
         # https://fastapi.tiangolo.com/tutorial/cors/
         self._app.add_middleware(
             CORSMiddleware,
-            # Related to https://github.com/nicolargo/glances/discussions/2802
-            # allow_origins=[self.bind_url],
-            allow_origins=["*"],
-            allow_credentials=True,
-            allow_methods=["*"],
-            allow_headers=["*"],
+            # Related to https://github.com/nicolargo/glances/issues/2812
+            allow_origins=config.get_list_value('outputs', 'cors_origins', default=["*"]),
+            allow_credentials=config.get_bool_value('outputs', 'cors_credentials', default=True),
+            allow_methods=config.get_list_value('outputs', 'cors_methods', default=["*"]),
+            allow_headers=config.get_list_value('outputs', 'cors_headers', default=["*"]),
         )
 
         # FastAPI Enable GZIP compression