Fixing cors origin wildcard. (#5194)

* Fixing cors origin wildcard.

- Fixes #5185

* Add other allows to specified origin block.

* Fix clippy.

config/defaults.hjson

@@ -122,5 +122,5 @@
   }
   # Sets a response Access-Control-Allow-Origin CORS header
   # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
-  cors_origin: "*"
+  cors_origin: "lemmy.tld"
 }

crates/utils/src/settings/structs.rs

@@ -52,7 +52,7 @@ pub struct Settings {
   /// Sets a response Access-Control-Allow-Origin CORS header
   /// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
   #[default(None)]
-  #[doku(example = "*")]
+  #[doku(example = "lemmy.tld")]
   cors_origin: Option<String>,
 }
 

src/lib.rs

@@ -339,23 +339,31 @@ fn create_http_server(
 fn cors_config(settings: &Settings) -> Cors {
   let self_origin = settings.get_protocol_and_hostname();
   let cors_origin_setting = settings.cors_origin();
-  match (cors_origin_setting.clone(), cfg!(debug_assertions)) {
-    (Some(origin), false) => {
-      // Need to call send_wildcard() explicitly, passing this into allowed_origin() results in
-      // error
-      if cors_origin_setting.as_deref() == Some("*") {
-        Cors::default().allow_any_origin().send_wildcard()
-      } else {
-        Cors::default()
-          .allowed_origin(&origin)
-          .allowed_origin(&self_origin)
-      }
-    }
-    _ => Cors::default()
+
+  // A default setting for either wildcard, or None
+  let cors_default = Cors::default()
     .allow_any_origin()
     .allow_any_method()
     .allow_any_header()
     .expose_any_header()
-      .max_age(3600),
+    .max_age(3600);
+
+  match (cors_origin_setting.clone(), cfg!(debug_assertions)) {
+    (Some(origin), false) => {
+      // Need to call send_wildcard() explicitly, passing this into allowed_origin() results in
+      // error
+      if origin == "*" {
+        cors_default
+      } else {
+        Cors::default()
+          .allowed_origin(&origin)
+          .allowed_origin(&self_origin)
+          .allow_any_method()
+          .allow_any_header()
+          .expose_any_header()
+          .max_age(3600)
+      }
+    }
+    _ => cors_default,
   }
 }