From a23267dd536aa9c981dece01ea60725ca6f6b132 Mon Sep 17 00:00:00 2001
From: Jianhui Zhao <zhaojh329@gmail.com>
Date: Sun, 15 Jun 2025 00:08:21 +0800
Subject: [PATCH] feat: Add option `allow-origins`

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
---
 api.go           | 18 ++++++------------
 config/config.go |  3 +++
 go.mod           |  1 +
 go.sum           |  2 ++
 main.go          |  4 ++++
 rttys.conf       |  3 +++
 6 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/api.go b/api.go
index 4c80e1f..4df2d62 100644
--- a/api.go
+++ b/api.go
@@ -13,6 +13,7 @@ import (
 	"rttys/utils"
 
 	"github.com/fanjindong/go-cache"
+	"github.com/gin-contrib/cors"
 	"github.com/gin-gonic/gin"
 	"github.com/rs/zerolog/log"
 )
@@ -24,12 +25,6 @@ const httpSessionExpire = 30 * time.Minute
 //go:embed ui/dist
 var staticFs embed.FS
 
-func allowOrigin(w http.ResponseWriter) {
-	w.Header().Set("Access-Control-Allow-Origin", "*")
-	w.Header().Add("Access-Control-Allow-Headers", "Content-Type")
-	w.Header().Set("content-type", "application/json")
-}
-
 func httpLogin(cfg *config.Config, password string) bool {
 	return cfg.Password == "" || cfg.Password == password
 }
@@ -63,6 +58,11 @@ func apiStart(br *broker) {
 
 	r.Use(gin.Recovery())
 
+	if cfg.AllowOrigins {
+		log.Debug().Msg("Allow all origins")
+		r.Use(cors.Default())
+	}
+
 	authorized := r.Group("/", func(c *gin.Context) {
 		if !cfg.LocalAuth && isLocalRequest(c) {
 			return
@@ -113,14 +113,10 @@ func apiStart(br *broker) {
 			return true
 		})
 
-		allowOrigin(c.Writer)
-
 		c.JSON(http.StatusOK, devs)
 	})
 
 	authorized.GET("/dev/:devid", func(c *gin.Context) {
-		allowOrigin(c.Writer)
-
 		if dev, ok := br.getDevice(c.Param("devid")); ok {
 			c.JSON(http.StatusOK, gin.H{
 				"description": dev.desc,
@@ -134,8 +130,6 @@ func apiStart(br *broker) {
 	})
 
 	authorized.POST("/cmd/:devid", func(c *gin.Context) {
-		allowOrigin(c.Writer)
-
 		handleCmdReq(br, c)
 	})
 
diff --git a/config/config.go b/config/config.go
index 0c4bebd..e50615b 100644
--- a/config/config.go
+++ b/config/config.go
@@ -27,6 +27,7 @@ type Config struct {
 	LocalAuth            bool
 	SeparateSslConfig    bool
 	Password             string
+	AllowOrigins         bool
 }
 
 func getConfigOpt(yamlCfg *yaml.File, name string, opt any) {
@@ -70,6 +71,7 @@ func parseYamlCfg(cfg *Config, conf string) error {
 	getConfigOpt(yamlCfg, "dev-hook-url", &cfg.DevHookUrl)
 	getConfigOpt(yamlCfg, "local-auth", &cfg.LocalAuth)
 	getConfigOpt(yamlCfg, "password", &cfg.Password)
+	getConfigOpt(yamlCfg, "allow-origins", &cfg.AllowOrigins)
 
 	return nil
 }
@@ -114,6 +116,7 @@ func Parse(c *cli.Context) (*Config, error) {
 	getFlagOpt(c, "local-auth", &cfg.LocalAuth)
 	getFlagOpt(c, "token", &cfg.Token)
 	getFlagOpt(c, "password", &cfg.Password)
+	getFlagOpt(c, "allow-origins", &cfg.AllowOrigins)
 
 	getFlagOpt(c, "ssl-cacert", &cfg.SslCacert)
 	getFlagOpt(c, "ssl-cert", &cfg.SslCert)
diff --git a/go.mod b/go.mod
index 5933474..96c3ebc 100644
--- a/go.mod
+++ b/go.mod
@@ -7,6 +7,7 @@ toolchain go1.24.4
 require (
 	github.com/dwdcth/consoleEx v0.0.0-20180521133551-f56f6eb78b76
 	github.com/fanjindong/go-cache v0.0.6
+	github.com/gin-contrib/cors v1.7.5
 	github.com/gin-gonic/gin v1.10.1
 	github.com/gorilla/websocket v1.5.3
 	github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef
diff --git a/go.sum b/go.sum
index 48a3b23..1943db3 100644
--- a/go.sum
+++ b/go.sum
@@ -18,6 +18,8 @@ github.com/fanjindong/go-cache v0.0.6 h1:4xl8MnfW8pFLH9cRjs0uNfVbFNqV342yl/pgX3Q
 github.com/fanjindong/go-cache v0.0.6/go.mod h1:gxehZ3SqUVta6eFBJAcDlXDT2Q9piXkUqv7s4E0Vj6o=
 github.com/gabriel-vasile/mimetype v1.4.9 h1:5k+WDwEsD9eTLL8Tz3L0VnmVh9QxGjRmjBvAG7U/oYY=
 github.com/gabriel-vasile/mimetype v1.4.9/go.mod h1:WnSQhFKJuBlRyLiKohA/2DtIlPFAbguNaG7QCHcyGok=
+github.com/gin-contrib/cors v1.7.5 h1:cXC9SmofOrRg0w9PigwGlHG3ztswH6bqq4vJVXnvYMk=
+github.com/gin-contrib/cors v1.7.5/go.mod h1:4q3yi7xBEDDWKapjT2o1V7mScKDDr8k+jZ0fSquGoy0=
 github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
 github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
 github.com/gin-gonic/gin v1.10.1 h1:T0ujvqyCSqRopADpgPgiTT63DUQVSfojyME59Ei63pQ=
diff --git a/main.go b/main.go
index 85738ae..f764c33 100644
--- a/main.go
+++ b/main.go
@@ -147,6 +147,10 @@ func main() {
 						Name:  "password",
 						Usage: "web management password",
 					},
+					&cli.BoolFlag{
+						Name:  "allow-origins",
+						Usage: "allow all origins for cross-domain request",
+					},
 					&cli.BoolFlag{
 						Name:    "verbose",
 						Aliases: []string{"V"},
diff --git a/rttys.conf b/rttys.conf
index 852a58d..6d11a46 100644
--- a/rttys.conf
+++ b/rttys.conf
@@ -32,3 +32,6 @@
 
 # Web Management password
 #password: rttys
+
+# Allow all origins for cross-domain request
+#allow-origins: false