CORS for Gramps Web API

Gramps Web
1

Hello,

I want to create a small web page with summarizes me some content stored in Gramps Web. But as this page is served from a different location than the backend, I get CORS errors.

As CORS is just a client-side (browser) implementation, there is no security benefit for the backend, as other clients can just connect to the backend.

Therefore, my proposal is to add CORS header (Access-Control-Allow-Origin: *) to the backend responses.

Before creating a corresponding feature/pull request I wanted to discuss the implications here. Are there any arguments against this change?

Thanks

Sven

2

Sure, use CORS_ORIGINS, see Server configuration - Gramps Web.

3

Thanks for the hint, I missed that configuration.
Is there a good reason to not have it set per default?

4

Well … I think it makes sense to be more cautious by default and it’s trivial to change. It’s true that it doesn’t bring a security benefit for the backend, but it’s still not completely useless for the frontend/backend combination, depending on what the server owner wants…