Set custom CORS to prevent clients from connecting to streaming

[irg1008]

Is there a way to set CORS to prevent clients from watching streamings from unauthorized origins after gaining viewing token?

[Thulinma]

Good question! Currently, CORS headers are hardcoded to allow all access.
It would be pretty easy to hardcode something else, see: https://github.com/DDVTECH/mistserver/blob/master/lib/http_parser.cpp#L131-L143

We've been wanting to make this configurable, but never got around to it. It will probably happen at some point, but if you want something fast I'd recommend editing those lines of code to suit your needs and compiling it yourself.

[irg1008]

Hmm I see, how could set that to get from Env Var for the moment?

[irg1008]

Maybe an alternative way would be to send origin in NEW_USER trigger?