update the default cors configs (zooniverse#3210)

match the changes from in zooniverse#3206 and zooniverse#3199
zwolf · Mar 24, 2020 · f745980 · f745980
1 parent 6022e71
commit f745980
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/config/cors_config.yml.hudson b/config/cors_config.yml.hudson
@@ -4,7 +4,11 @@ default: &default
  expose: [ ETag, X-CSRF-Token ]
  max_age: 300
  allows:
- - {origins: '*', resource: '*'}
+ - { origins: !ruby/regexp '/^https?:\/\/(127\.0\.0\.1|localhost|[a-z0-9-]+\.local)(:\d+)?$/', resource: '/users*', credentials: true }
+ - { origins: !ruby/regexp '/^https?:\/\/(127\.0\.0\.1|localhost|[a-z0-9-]+\.local)(:\d+)?$/', resource: '/oauth/*', credentials: true }
+ - { origins: '*', resource: '/api/*' }
+ - { origins: '*', resource: '/graphql' }
+
 
 development:
  <<: *default