diff options
Diffstat (limited to 'src/api/mod.rs')
| -rw-r--r-- | src/api/mod.rs | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/api/mod.rs b/src/api/mod.rs index b62163e..38868e2 100644 --- a/src/api/mod.rs +++ b/src/api/mod.rs @@ -5,6 +5,7 @@ mod access; pub(crate) mod auth; mod changes; mod config; +mod cors; #[cfg(feature = "dashboard")] mod dashboard; mod debug; @@ -105,6 +106,9 @@ pub(crate) fn router(state: AppState, auth_state: AuthState, debug_api: bool) -> .layer(middleware::from_fn_with_state(auth_state, basic_auth)) // Outside authentication: a token, if the request brings one, names the user. .layer(middleware::from_fn_with_state(state.clone(), login::bearer)) + // Outermost: pages of other origins, and their preflights, which bring no + // credentials. + .layer(middleware::from_fn_with_state(state.clone(), cors::cors)) // The hand-written spec (`docs/openapi.yaml`), and the Swagger UI showing it. .merge( // Relative to the UI's page (`/swagger-ui/`), so it is found behind a proxy that |