Allow disabling setting CORS headers

[brancz]

Is your proposal related to a problem?

We have a proxy in front of Thanos that manages things like authentication etc. which has it's own CORS policy, but since Thanos also sets CORS headers they end up being set multiple times which ends up conflicting.

Describe the solution you'd like

Add a flag --disable-cors. That causes no CORS headers to be set.

Describe alternatives you've considered

Can't really think of another way, except maybe allowing more specific CORS configuration, but that doesn't appear to have been a problem for anyone else so far.

@thanos-io/thanos-maintainers

[onprem]

I think we can use the proxy in front of Thanos to override these headers, can't we?

But having a flag sounds doable as well.

[brancz]

Not really, as headers are written first, so what happens is

1. our proxy sets CORS headers
2. thanos sets CORS headers (and "wins" the conflict)
3. thanos returns body

Once a body is written it is impossible to write headers, so there's really no other option.