avi/Traefik_Control
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add Certificates page and Traefik API frontend client

Browse source
This commit is contained in:
backup 2026-09-02 12:42:52 -05:00
commit 7fc90524b5
40 changed files with 6585 additions and 359 deletions
Download patch file Download diff file Expand all files Collapse all files

7
backend/internal/api/middleware/auth.go
View file

@ -165,11 +165,16 @@ func RequireRole(allowedRoles ...string) gin.HandlerFunc {
}
func CORSMiddleware(allowedOrigin string) gin.HandlerFunc {
// Reject wildcard when credentials are enabled — browsers will block it anyway.
// Only the explicitly configured origin is allowed.
isWildcard := allowedOrigin == "*"
return func(c *gin.Context) {
origin := c.Request.Header.Get("Origin")
if origin == allowedOrigin || allowedOrigin == "*" {
if !isWildcard && origin != "" && origin == allowedOrigin {
c.Header("Access-Control-Allow-Origin", origin)
c.Header("Vary", "Origin")
}
// Explicitly do not set Access-Control-Allow-Origin to "*" when credentials are true
c.Header("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS")
c.Header("Access-Control-Allow-Headers", "Content-Type, Authorization, X-CSRF-Token")
c.Header("Access-Control-Allow-Credentials", "true")