Disable CORS for the public get_run api

vdbergh · ppigazzini · commit d93bcbbf0c16 · 2025-08-10T17:47:55.000+02:00
This only affects browsers. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS CORS is already disabled for the actions api.
diff --git a/server/fishtest/api.py b/server/fishtest/api.py
@@ -431,6 +431,8 @@ def get_run(self):
             self.handle_error(
                 f"The run {run_id} does not exist", exception=HTTPNotFound
             )
+        self.request.response.headers["access-control-allow-origin"] = "*"
+        self.request.response.headers["access-control-allow-headers"] = "content-type"
         return strip_run(run)
 
     @view_config(route_name="api_get_task")

Original file line number	Diff line number	Diff line change
`@@ -431,6 +431,8 @@ def get_run(self):`
`431`	`431`	`self.handle_error(`
`432`	`432`	`f"The run {run_id} does not exist", exception=HTTPNotFound`
`433`	`433`	`)`
	`434`	`+ self.request.response.headers["access-control-allow-origin"] = "*"`
	`435`	`+ self.request.response.headers["access-control-allow-headers"] = "content-type"`
`434`	`436`	`return strip_run(run)`
`435`	`437`
`436`	`438`	`@view_config(route_name="api_get_task")`