| 218 | } |
| 219 | |
| 220 | func newCorsHandler(srv *Server, allowedOrigins []string) http.Handler { |
| 221 | // disable CORS support if user has not specified a custom CORS configuration |
| 222 | if len(allowedOrigins) == 0 { |
| 223 | return srv |
| 224 | } |
| 225 | c := cors.New(cors.Options{ |
| 226 | AllowedOrigins: allowedOrigins, |
| 227 | AllowedMethods: []string{http.MethodPost, http.MethodGet}, |
| 228 | MaxAge: 600, |
| 229 | AllowedHeaders: []string{"*"}, |
| 230 | }) |
| 231 | return c.Handler(srv) |
| 232 | } |
| 233 | |
| 234 | // virtualHostHandler is a handler which validates the Host-header of incoming requests. |
| 235 | // The virtualHostHandler can prevent DNS rebinding attacks, which do not utilize CORS-headers, |