CORS Headers about imgproxy

[DarthSim]

HI.
I'm very sorry for the long period of inactivity.

CORS headers were added to the latest release. You need to set IMGPROXY_ALLOW_ORIGIN to enable them. See README.

[mattsrobot]

@DarthSim is it possible to allow multiple domains? I have two domains, one also that supports subdomains, using the image proxy, I'de like to restrict access only from these?

[uncvrd]

Following up on Matt's request for the ability to allow multiple domains in the IMGPROXY_ALLOW_ORIGIN if possible. Currently have to set to * to suit my needs but would like to restrict!

[DarthSim]

Here's the thing: Access-Control-Allow-Origin does not support multiple values and masking. Usually, applications respond with dynamic Access-Control-Allow-Origin that depends on the request origin. But in the case of imgproxy where you put a CDN or a caching server in front, this won't work properly.

[thibauds]

@DarthSim Maybe we could check if the Host or X-Forwarded-Host header is in the IMGPROXY_ALLOW_ORIGIN list and return it if there is a match?

[DarthSim]

@thibauds That's exactly what I'm talking about here:

Usually, applications respond with dynamic Access-Control-Allow-Origin that depends on the request origin. But in the case of imgproxy where you put a CDN or a caching server in front, this won't work properly.