Suggestion: allow to skip origin checks about nmrium-react-wrapper HOT 2 CLOSED

Hm, wait, this seems to be client side code. Of course process.env is not available then. So then, the ALLOWED_ORIGIN check is probably not for security anyway?

Can we get a build flag to disable it or maybe load the ALLOWED_ORIGINS list from a json file that I can simply clear before building?

How does this look to you:

src/allowed_origins.json:

[
    "https://nmrxiv.org",
    "http://nmrxiv.org",
    "http://localhost",
    "http://localhost:3000",
    "http://127.0.0.1:",
    "http://127.0.0.1:3000",
    "http://test.nmrxiv.org",
    "http://193.196.39.168",
    "http://193.196.39.168:3000",
    "https://nodejsdev.nmrxiv.org"
]

events.ts:

// in your events.ts
// replace the ALLOWED_ORIGINS definition with an import
import ALLOWED_ORIGINS from '../allowed_origins.json';
...
const skipOriginCheck = ALLOWED_ORIGINS.length == 0 || ALLOWED_ORIGINS.includes('*');
if (!skipOriginCheck && !ALLOWED_ORIGINS.includes(parseOrigin(origin))) {
    throw new Error(`Invalid Origin ${origin}`);
}
...

from nmrium-react-wrapper.

@ptrxyz

Thanks for your suggestions

from nmrium-react-wrapper.