mirror of
https://github.com/wiremock/WireMock.Net.git
synced 2026-01-11 14:20:29 +01:00
CORS headers for the admin API #103
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @alastairtree on GitHub (May 17, 2018).
Originally assigned to: @alastairtree on GitHub.
I have a requirement to support CORS requests on the admin API. Either I add these extra headers to all admin API responces, or i add a setting to enable them and allow users to switch them on as they wish. Normally I prefer security by default, and so CORS would be an opt-in feature, however in this case I cannot think of any realistic scenario where you would want to disable CORS support on the admin API. Wiremock is purely a test tool and not designed for production use, and besides it already has admin API security if needed, and CORS defence is to stop dodgy iframing, which does not seem relevant to wiremock. I think productivity weights more to me than security here - any reason not to just allow all CORS requests on the admin API?
@alastairtree commented on GitHub (May 18, 2018):
(Work started over at
06a7122d66)@StefH commented on GitHub (May 19, 2018):
CORS support sounds OK to add, at least when it's configurable.
In your code I see that you are adding the CORS header manually, isn't there an settings in OWIN to configure this?
@StefH commented on GitHub (Mar 9, 2020):
@alastairtree Any status on this one?
@StefH commented on GitHub (Nov 9, 2020):
@alastairtree Any updates on your work?
@alastairtree commented on GitHub (Nov 9, 2020):
No sorry, this stalled and I have not taken it any further. Realisticly I am unlikely to carry this on so maybe we should just close it?
@StefH commented on GitHub (Nov 9, 2020):
No problem. I'll just close this issue.
Take care !