actix: Fix CORS

The docs aren't entirely clear but suggest that the default allowed
origins is All.  But dbg! output seems to contradict this.  And we
should support more headers, and say that we don't vary our CORS at
all.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

diff --git a/daemon/main.rs b/daemon/main.rs
index 6e2a957353458820854b5005cd9aaf870537a3cf..d6d624675b4df28e54eab83d49e4ca51ad3952c1 100644 (file)
--- a/daemon/main.rs
+++ b/daemon/main.rs
@@ -280,9 +280,10 @@ impl<'r> FromFormValue<'r> for BundleToken {
 */
 
 fn updates_cors() -> Cors {
-
   Cors::default()
-      .allowed_methods([Method::GET])
+    .allow_any_origin()
+    .allowed_methods([Method::GET, Method::OPTIONS, Method::HEAD])
+    .disable_vary_header()
 }
 
 #[derive(Debug, Deserialize)]