Fix CORS Support

[jbenet]

This PR

• Fixes CORS bugs
• Improves support for CORS options
• Removes Referrer Checking
• Defaults to localhost/127.0.0.1 CORS Origins
• Allows Setting arbitrary HTTP headers on API responses

[jbenet]

@whyrusleeping @cryptix PTAL

[whyrusleeping]

seeing default first and implicit continues always weirds me out in the logic. maybe:

switch h{
    case "Access-Control-Allow-Origin":
       return true
    case "Access-Control-Allow-Methods":
       return true
    case "Access-Control-Allow-Credentials":
       return true
    default:
        return false
}

just to be explicit?

[whyrusleeping]

LGTM

[mappum]

CORS headers do not prevent CSRF attacks, so this doesn't restore the security of #1521. Here is an attack example, if your daemon is on this branch then visiting the page will pin something to your node: http://localhost:8080/ipfs/QmYeRGr8PY3yigx2aTvK8B9e4HVUy3h4b2r3tsZHaYBduD

(Note that the attack can come from any website you visit, it doesn't have to be an IPFS-hosted page).

Pinning arbitrary things is only a sort-of scary attack, but more critical attacks could be possible too (e.g. making someone publish the attacker's hash for their IPNS names).

[jbenet]

@mappum QmYeRGr8PY3yigx2aTvK8B9e4HVUy3h4b2r3tsZHaYBduD is not resolving -- pin on irc?

[daviddias]

@mappum To prevent CSRF, we should have some kind of token (a CSRF token of a JSON WebToken), blocking by referer header doesn't make it impenetrable and it can be annoying for web app devs.

[jbenet]

+1 for token, though it can also be annoying in its own right.

maybe:

var ipfs = ipfsApi(...)

could get the token async? not sure.

@mappum and @diasdavid would you discuss and decide? you know more about all the constraints than me

[jbenet]

I would really like to fix + merge this so we can release 0.3.6 soon-- it has lots of important bugfixes.

[jbenet]

aaaand done.