Settings Origin header acts as a strict requirement

[travisperson]

After setting ipfs config --json API.HTTPHeaders.Access-Control-Allow-Origin '["http://localhost:3000"]' requests made via port 5001 in a browser are no longer allowed.

This is only really noticeable in the WebUI (any browser really) as the browser sets a Referer header on every request.

All looks good

~ $ curl 'http://localhost:5001/api/v0/version' -H 'Referer: http://localhost:5001'
{"Version":"0.4.0-dev","Commit":"9e9aa4c","Repo":"3"}
~ $ curl 'http://localhost:5001/api/v0/version' -H 'Origin: http://localhost:5001'
{"Version":"0.4.0-dev","Commit":"9e9aa4c","Repo":"3"}

Update Origin

~ $ ipfs config --json API.HTTPHeaders.Access-Control-Allow-Origin '["http://localhost:3000"]'

Config changes don't appears to take effect yet

~ $ curl 'http://localhost:5001/api/v0/version' -H 'Referer: http://localhost:5001'
{"Version":"0.4.0-dev","Commit":"9e9aa4c","Repo":"3"}
~ $ curl 'http://localhost:5001/api/v0/version' -H 'Origin: http://localhost:5001'
{"Version":"0.4.0-dev","Commit":"9e9aa4c","Repo":"3"}
~ $ curl 'http://localhost:5001/api/v0/version'
{"Version":"0.4.0-dev","Commit":"9e9aa4c","Repo":"3"}
~ $ curl 'http://localhost:5001/api/v0/version' -H 'Referer: http://localhost:3000'
403 - Forbidden
~ $ curl 'http://localhost:5001/api/v0/version' -H 'Origin: http://localhost:3000'
403 - Forbidden

Restarted IPFS Daemon

~ $ curl 'http://localhost:5001/api/v0/version' -H 'Referer: http://localhost:5001'
403 - Forbidden
~ $ curl 'http://localhost:5001/api/v0/version' -H 'Origin: http://localhost:5001'
403 - Forbidden

With port 3000

~ $ curl 'http://localhost:5001/api/v0/version' -H 'Referer: http://localhost:3000'
{"Version":"0.4.0-dev","Commit":"9e9aa4c","Repo":"3"}
~ $ curl 'http://localhost:5001/api/v0/version' -H 'Origin: http://localhost:3000'
{"Version":"0.4.0-dev","Commit":"9e9aa4c","Repo":"3"}

I'd suspect that even with an Access-Control-Allow-Origin requests made on port 5001 should still work.

[rht]

If this were to be handled, then every config update has to propagate to the daemon immediately/when needed. This is possible when the config param is read from disk/cache every time the value is called, which could be a huge perf hit for large number of requests. I don't think adding the complexity is worth it here.

[whyrusleeping]

I think we can close this as 'wont fix'. Or at least, not something we have a convincing use-case for at this time. The complexity of implementing this would be pretty high.