starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[PR #4557] [MERGED] Allow a whitelist of CORS origins #4283

New Issue
Closed
opened 2026-04-25 00:19:08 +02:00 by adam · 0 comments
adam commented 2026-04-25 00:19:08 +02:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/advplyr/audiobookshelf/pull/4557
Author: @Vito0912
Created: 8/3/2025
Status: ✅ Merged
Merged: 8/5/2025
Merged by: @advplyr

Base: master ← Head: cors

📝 Commits (7)

  • 6a52d2a CORS
  • af67c2e locale
  • e408070 better heading
  • 1097de6 now updates the input field
  • df3878d Add Security section to settings with allowed cors origin setting, increase width of setting inputs
  • 1908ec3 Remove commented out experimental features setting
  • 08c9e8d Fix i18n string order

📊 Changes

4 files changed (+38 additions, -19 deletions)

View changed files

📝 client/pages/config/index.vue (+30 -17)
📝 client/strings/en-us.json (+3 -0)
📝 server/Server.js (+2 -2)
📝 server/objects/settings/ServerSettings.js (+3 -0)

📄 Description

Brief summary

As more tools become available for ABS, they depend on the browser to make requests.
Because of CORS, this is not possible. Right now, there is no simple way to enable CORS without using environment variables, and there is no option to allow it for specific origins, which would be better.
Because of this, some people use proxy methods, which put users at high risk of abuse and stolen credentials. This PR adds an option to let certain origins make requests with CORS.

Which issue is fixed?

In-depth Description

How have you tested this?

My own online toolbox

Screenshots

grafik

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/advplyr/audiobookshelf/pull/4557 **Author:** [@Vito0912](https://github.com/Vito0912) **Created:** 8/3/2025 **Status:** ✅ Merged **Merged:** 8/5/2025 **Merged by:** [@advplyr](https://github.com/advplyr) **Base:** `master` ← **Head:** `cors` --- ### 📝 Commits (7) - [`6a52d2a`](https://github.com/advplyr/audiobookshelf/commit/6a52d2a96844d0e53043ceaf14fe05a3a507c52f) CORS - [`af67c2e`](https://github.com/advplyr/audiobookshelf/commit/af67c2e86f9659a37dced10311d5f17add278aac) locale - [`e408070`](https://github.com/advplyr/audiobookshelf/commit/e408070b19c0f6aacb436cd639e76f46603a6e0e) better heading - [`1097de6`](https://github.com/advplyr/audiobookshelf/commit/1097de6f1fdfaa78c8e9105c1cb7efd1e352a2e9) now updates the input field - [`df3878d`](https://github.com/advplyr/audiobookshelf/commit/df3878d4cad448d0f450845059724bec200bdb31) Add Security section to settings with allowed cors origin setting, increase width of setting inputs - [`1908ec3`](https://github.com/advplyr/audiobookshelf/commit/1908ec3df5a18d4fcfb28a171e29ec69c2eaf532) Remove commented out experimental features setting - [`08c9e8d`](https://github.com/advplyr/audiobookshelf/commit/08c9e8d47d76c29b2ad78731ffb09061a6d131ee) Fix i18n string order ### 📊 Changes **4 files changed** (+38 additions, -19 deletions) <details> <summary>View changed files</summary> 📝 `client/pages/config/index.vue` (+30 -17) 📝 `client/strings/en-us.json` (+3 -0) 📝 `server/Server.js` (+2 -2) 📝 `server/objects/settings/ServerSettings.js` (+3 -0) </details> ### 📄 Description <!-- For Work In Progress Pull Requests, please use the Draft PR feature, see https://github.blog/2019-02-14-introducing-draft-pull-requests/ for further details. If you do not follow this template, the PR may be closed without review. Please ensure all checks pass. If you are a new contributor, the workflows will need to be manually approved before they run. --> ## Brief summary As more tools become available for ABS, they depend on the browser to make requests. Because of CORS, this is not possible. Right now, there is no simple way to enable CORS without using environment variables, and there is no option to allow it for specific origins, which would be better. Because of this, some people use proxy methods, which put users at high risk of abuse and stolen credentials. This PR adds an option to let certain origins make requests with CORS. ## Which issue is fixed? <!-- Which issue number does this PR fix? Ex: "Fixes #1234" --> ## In-depth Description <!-- Describe your solution in more depth. How does it work? Why is this the best solution? Does it solve a problem that affects multiple users or is this an edge case for your setup? --> ## How have you tested this? My own online toolbox ## Screenshots <!-- If your PR includes any changes to the web client, please include screenshots or a short video from before and after your changes. --> <img width="970" height="661" alt="grafik" src="https://github.com/user-attachments/assets/af4cd9ea-0d42-4cdd-8b9d-4191c6fdd07d" /> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2026-04-25 00:19:08 +02:00
adam closed this issue 2026-04-25 00:19:08 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#4283
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?