Replaced cors library

.env.dist

@@ -110,6 +110,16 @@ WG_UI_INITIAL_PASSWORD=random
 # Default: *
 WG_UI_CORS_ALLOWED_ORIGINS=*
 
+# CORS allow credentials
+# Indicates whether the request can include user credentials like cookies, HTTP authentication or client side SSL certificates.
+# Default: true
+WG_UI_CORS_ALLOW_CREDENTIALS=true
+
+# CORS allow private network
+# Indicates whether to accept cross-origin requests over a private network.
+# Default: false
+WG_UI_CORS_ALLOW_PRIVATE_NETWORK=false
+
 # Subscription allowed origins
 # Multiple origins are supported separated by comma
 # Example: localhost:3000,sandbox.embed.apollographql.com,wg-ui.your-domain.com

api/router.go

@@ -24,18 +24,17 @@ import (
 	"github.com/UnAfraid/wg-ui/user"
 	"github.com/UnAfraid/wg-ui/wg"
 	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/cors"
 	"github.com/gorilla/websocket"
+	"github.com/rs/cors"
 )
 
 const (
 	dataLoaderWait     = 250 * time.Microsecond
-	dataLoaderMaxBatch = 100
+	dataLoaderMaxBatch = 1000
 )
 
 func NewRouter(
 	conf *config.Config,
-	corsAllowedOrigins []string,
 	authService auth.Service,
 	nodeSubscriptionService subscription.NodeService,
 	userService user.Service,
@@ -47,10 +46,11 @@ func NewRouter(
 	wgService wg.Service,
 ) http.Handler {
 	corsMiddleware := cors.New(cors.Options{
-		AllowedOrigins:   corsAllowedOrigins,
-		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
-		AllowedHeaders:   []string{"*"},
-		AllowCredentials: true,
+		AllowedOrigins:      conf.CorsAllowedOrigins,
+		AllowedMethods:      []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
+		AllowedHeaders:      []string{"*"},
+		AllowCredentials:    conf.CorsAllowCredentials,
+		AllowPrivateNetwork: conf.CorsAllowPrivateNetwork,
 	})
 
 	executableSchemaConfig := newConfig(

config/config.go

@@ -14,6 +14,8 @@ type Config struct {
 	DebugServer                *DebugServer  `split_words:"true"`
 	Initial                    *Initial      `required:"true"`
 	CorsAllowedOrigins         []string      `split_words:"true" default:"*"`
+	CorsAllowCredentials       bool          `split_words:"true" default:"true"`
+	CorsAllowPrivateNetwork    bool          `split_words:"true" default:"false"`
 	SubscriptionAllowedOrigins []string      `split_words:"true" default:"*"`
 	JwtSecret                  string        `required:"true" split_words:"true"`
 	JwtDuration                time.Duration `split_words:"true" default:"8h"`

go.mod

@@ -7,13 +7,13 @@ require (
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
 	github.com/glendc/go-external-ip v0.1.0
 	github.com/go-chi/chi/v5 v5.0.8
-	github.com/go-chi/cors v1.2.1
 	github.com/golang-jwt/jwt/v5 v5.0.0
 	github.com/google/uuid v1.3.0
 	github.com/gorilla/websocket v1.5.0
 	github.com/graph-gophers/dataloader/v7 v7.1.0
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/kelseyhightower/envconfig v1.4.0
+	github.com/rs/cors v1.9.0
 	github.com/sirupsen/logrus v1.9.3
 	github.com/twelvedata/searchindex v1.0.1
 	github.com/vektah/gqlparser/v2 v2.5.6

go.sum

@@ -20,8 +20,6 @@ github.com/glendc/go-external-ip v0.1.0 h1:iX3xQ2Q26atAmLTbd++nUce2P5ht5P4uD4V7c
 github.com/glendc/go-external-ip v0.1.0/go.mod h1:CNx312s2FLAJoWNdJWZ2Fpf5O4oLsMFwuYviHjS4uJE=
 github.com/go-chi/chi/v5 v5.0.8 h1:lD+NLqFcAi1ovnVZpsnObHGW4xb4J8lNmoYVfECH1Y0=
 github.com/go-chi/chi/v5 v5.0.8/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
-github.com/go-chi/cors v1.2.1 h1:xEC8UT3Rlp2QuWNEr4Fs/c2EAGVKBwy/1vHx3bppil4=
-github.com/go-chi/cors v1.2.1/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
 github.com/golang-jwt/jwt/v5 v5.0.0 h1:1n1XNM9hk7O9mnQoNBGolZvzebBQ7p93ULHRc28XJUE=
 github.com/golang-jwt/jwt/v5 v5.0.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
@@ -65,6 +63,8 @@ github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLA
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
+github.com/rs/cors v1.9.0 h1:l9HGsTsHJcvW14Nk7J9KFz8bzeAWXn3CG6bgt7LsrAE=
+github.com/rs/cors v1.9.0/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=

main.go

@@ -159,7 +159,6 @@ func main() {
 
 	router := api.NewRouter(
 		conf,
-		conf.CorsAllowedOrigins,
 		authService,
 		nodeSubscriptionService,
 		userService,