Add `Authorization` to `Access-Control-Allow-Headers` and set `Access-Control-Allow-Credentials: true`

[waweber]

Is your feature request related to a problem? Please describe.
An application that interacts with the API via a browser cannot set the Authorization header due to the CORS headers returned by the server.

Describe the solution you'd like
Add Authorization to the Access-Control-Allow-Headers CORS headers, and set Access-Control-Allow-Credentials: true to allow web clients to specify an API token.

Unrelated to this specific issue: The Content-Type header might also be useful to include, since some request libraries attempt to read this header to check for JSON, and also Access-Control-Max-Age to cache CORS results would be useful.

[knadh]

Hi @waweber. Just curious, could you describe the context in which you're using this? Shipping an API token to the UI and making a request from the browser is extremely dangerous.

[waweber]

I am writing a small single page app for internal use to extend the application/automate specific tasks (e.g. drag and drop a csv file to compare/merge subscriber data). It's simple enough that there isn't a need for a backend server or client application. The user must supply their own API key out-of-band.

In terms of security, the most appropriate way of handling this would be to implement OAuth to allow third party applications to use the API on behalf of the user. In that case, these CORS headers would still be required as the client would still need to populate the Authorization header with an access token. With traditional API keys, the security concerns are similar to any OAuth public client, the main problem being having to safely hand copy long lived tokens around.

A similar app that works this way is the self hosted short URL service Shlink. The main UI is a separate application used via the browser, users must supply their own API keys out of band, stored locally.

[knadh]

Got it. For now, do you have a reverse proxy like Nginx sitting in front of the listmonk instance that could add these headers?

[waweber]

I do, that's my current workaround.