Use weak CORS policy for experimental_no_subdomain

2026-04-27 18:51:45 -05:00 · 2024-04-05 16:51:57 -04:00
parent fe88880486
commit 343edbff51
1 changed files with 4 additions and 1 deletions
@@ -291,7 +291,10 @@ class WebServerService extends BaseService {
                res.setHeader('Access-Control-Allow-Origin', origin ?? '*');
            }
            // Website(s) to allow to connect
-            if ( req.subdomains[req.subdomains.length-1] === 'api' ) {
+            if (
+                config.experimental_no_subdomain ||
+                req.subdomains[req.subdomains.length-1] === 'api'
+            ) {
                res.setHeader('Access-Control-Allow-Origin', origin ?? '*');
                res.setHeader('Access-Control-Allow-Credentials', 'true');
            }