Added CORS middleware

This prevents Micropub requests fired from web apps on other domains
from being blocked by overzealous browsers.

2 files changed, 23 insertions, 0 deletions

diff --git a/src/lib.rs b/src/lib.rs
index d39aa5e..398c3b2 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -5,6 +5,7 @@ mod frontend;
 mod indieauth;
 mod micropub;
 
+use crate::micropub::CORSMiddleware;
 use crate::indieauth::IndieAuthMiddleware;
 
 #[derive(Clone)]
@@ -29,6 +30,7 @@ where
     Storage: database::Storage + Send + Sync + Clone,
 {
     app.at("/micropub")
+        .with(CORSMiddleware {})
         .with(IndieAuthMiddleware::new())
         .get(micropub::get_handler)
         .post(micropub::post_handler);
diff --git a/src/micropub/mod.rs b/src/micropub/mod.rs
index 68a3134..84b9083 100644
--- a/src/micropub/mod.rs
+++ b/src/micropub/mod.rs
@@ -4,3 +4,24 @@ pub mod post;
 pub use get::get_handler;
 pub use post::normalize_mf2;
 pub use post::post_handler;
+
+pub struct CORSMiddleware {}
+
+use async_trait::async_trait;
+use tide::{Next, Request, Result};
+use crate::database;
+use crate::ApplicationState;
+
+#[async_trait]
+impl<B> tide::Middleware<ApplicationState<B>> for CORSMiddleware
+where
+    B: database::Storage + Send + Sync + Clone,
+{
+    async fn handle(&self, req: Request<ApplicationState<B>>, next: Next<'_, ApplicationState<B>>) -> Result {
+        let mut res = next.run(req).await;
+
+        res.insert_header("Access-Control-Allow-Origin", "*");
+
+        Ok(res)
+    }
+}