cors: allow every origin hostname, in case host header is rewritten

PostHog · Nov 14, 2023 · 3d78f75 · 3d78f75
1 parent 0b1b0a2
commit 3d78f75
Showing 1 changed file with 1 addition and 5 deletions.
diff --git a/capture/src/router.rs b/capture/src/router.rs
@@ -47,11 +47,7 @@ pub fn router<
 
     // Very permissive CORS policy, as old SDK versions
     // and reverse proxies might send funky headers.
-    let cors = CorsLayer::new()
-        .allow_methods([Method::GET, Method::POST, Method::OPTIONS])
-        .allow_headers(AllowHeaders::mirror_request())
-        .allow_credentials(true)
-        .allow_origin(AllowOrigin::mirror_request());
+    let cors = CorsLayer::very_permissive();
 
     let router = Router::new()
         // TODO: use NormalizePathLayer::trim_trailing_slash