So, there is a way to allow JS API requests from domains other than where you Discourse is hosted. For example, you’d like to embed a topic list that is a result of search by some criteria - and you want to do it with JavaScript only, making it call your Discourse’s API. For this to work, you’ll need to enable Cross-origin resource sharing: [图片] How can I enable Cross-origin Resource Sharing with Docker? Modify these settings in app.yml file: DISCOURSE_ENABLE_CORS: true DISCOURSE_CORS_ORIGIN: ‘*’ For a multi-site setup, you can also use a per-instance setting: [图片] (…see more here) Now The Question: Are there ANY risks by enabling it? Be it tiny, small, medium or large, may you elaborate please - which are the risks, drawbacks or other negative sides of enabling cross-origins for a particular domain.

See here: [YSY] Why is the same origin policy so important? web-application, web-browser, javascript, same-origin-policy asked by YSY on 10:34PM - 19 Oct 11 UTC Bottom line, it is a very bad idea to enable *

In general, is still bad for enabling a single domain only?

Allowing sites you do not control CORS access is a bad idea.

So, the only really safe way to query API from a different domain would be to allow JSONP: either by origin domain or by api_username/key, right? If that’s correct, I’ve seen some discussion about JSONP in this topic - have it been considered for implementation eventually?

What are the risks of enabling Cross-origin resource sharing (DISCOURSE_ENABLE_CORS)

Product Support

sam (Sam Saffron) 2016 年3 月 18 日 03:23 2

See here:

Bottom line, it is a very bad idea to enable *

话题		回复	浏览量
Setup Cross-Origin Resource Sharing (CORS) Self-Hosting how-to	8	2324	2026 年1 月 13 日
What is the purpose of Settings -> Security -> CORS origins vs similar environment setting? Product Support	2	3773	2015 年11 月 9 日
CORS issue with javascript frontend Self-hosting	1	742	2020 年7 月 20 日
Set DISCOURSE_ENABLE_CORS for hosted forum Self-hosting hosting	5	2639	2022 年10 月 7 日
Where I should go to set the `DISCOURSE_ENABLE_CORS` env variable? Product Support	16	1379	2022 年12 月 27 日

What are the risks of enabling Cross-origin resource sharing (DISCOURSE_ENABLE_CORS)

相关话题