Move CORS layer to a seperate feature

server/Cargo.toml

@@ -22,15 +22,15 @@ parquet = "^47.0.0"
 arrow-flight = "47.0.0"
 tonic = "0.10.0"
 tonic-web = "0.10.0"
-tower-http = { version = "0.4.4", features = ["cors"] }
+tower-http = { version = "0.4.4", features = ["cors"], optional = true }
 
 ### actix dependencies
 actix-web-httpauth = "0.8"
 actix-web = { version = "4.3", features = ["rustls"] }
-actix-cors = "0.6"
 actix-web-prometheus = { version = "0.1" }
 actix-web-static-files = "4.0"
 mime = "0.3.17"
+actix-cors = { version = "0.6", optional = true }
 
 ### other dependencies
 anyhow = { version = "1.0", features = ["backtrace"] }
@@ -118,4 +118,5 @@ assets-url = "https://github.com/parseablehq/console/releases/download/v0.3.1/bu
 assets-sha1 = "6abd7b5ca5b9c832ff58b8450cffdc83dd7172bf"
 
 [features]
-debug = []
+permissive_cors = ["dep:tower-http", "dep:actix-cors"]
+debug = ["permissive_cors"]

server/src/handlers/http.rs

@@ -20,7 +20,6 @@
 use std::io::BufReader;
 use std::sync::Arc;
 
-use actix_cors::Cors;
 use actix_web::{
     web::{self, resource},
     App, HttpServer,
@@ -32,6 +31,9 @@
 use rustls::{Certificate, PrivateKey, ServerConfig};
 use rustls_pemfile::{certs, pkcs8_private_keys};
 
+#[cfg(feature = "permissive_cors")]
+use actix_cors::Cors;
+
 use crate::option::CONFIG;
 use crate::rbac::role::Action;
 
@@ -69,12 +71,16 @@
     };
 
     let create_app = move || {
-        App::new()
+        let app = App::new()
             .wrap(prometheus.clone())
             .configure(|cfg| configure_routes(cfg, oidc_client.clone()))
             .wrap(actix_web::middleware::Logger::default())
-            .wrap(actix_web::middleware::Compress::default())
-            .wrap(cross_origin_config())
+            .wrap(actix_web::middleware::Compress::default());
+
+        #[cfg(feature = "permissive_cors")]
+        let app = app.wrap(Cors::permissive());
+
+        app
     };
 
     let ssl_acceptor = match (
@@ -335,11 +341,3 @@
 pub fn metrics_path() -> String {
     format!("{}/metrics", base_path())
 }
-
-fn cross_origin_config() -> Cors {
-    if cfg!(feature = "debug") {
-        Cors::permissive()
-    } else {
-        Cors::default()
-    }
-}

server/src/handlers/livetail.rs

@@ -35,6 +35,7 @@ use arrow_flight::{
     HandshakeResponse, PutResult, SchemaResult, Ticket,
 };
 use tonic_web::GrpcWebLayer;
+#[cfg(feature = "permissive_cors")]
 use tower_http::cors::CorsLayer;
 
 use crate::livetail::{Message, LIVETAIL};
@@ -174,11 +175,12 @@ pub fn server() -> impl Future<Output = Result<(), Box<dyn std::error::Error + S
 
     let svc = FlightServiceServer::new(service);
 
-    let cors = cross_origin_config();
+    let builder = Server::builder().accept_http1(true);
 
-    Server::builder()
-        .accept_http1(true)
-        .layer(cors)
+    #[cfg(feature = "permissive_cors")]
+    let builder = builder.layer(CorsLayer::very_permissive().allow_credentials(true));
+
+    builder
         .layer(GrpcWebLayer::new())
         .add_service(svc)
         .serve(addr)
@@ -235,11 +237,3 @@ fn extract_cookie(header: &MetadataMap) -> Option<Cookie> {
         .flatten()
         .find(|cookie| cookie.name() == SESSION_COOKIE_NAME)
 }
-
-fn cross_origin_config() -> CorsLayer {
-    if cfg!(feature = "debug") {
-        CorsLayer::very_permissive().allow_credentials(true)
-    } else {
-        CorsLayer::new()
-    }
-}