How to enable CORS headers with terracotta serve?

When trying the new terracotta preview against a locally run terracotta serve, I get errors because of missing CORS headers.

This issue is popping up now, because the new preview app is using Mapbox as a map provider instead of Leaflet and data is now loaded programmatically instead of just pasting the PNG links into the browser (which do not requite CORS headers). Anways.

I tried to set TC_ALLOWED_ORIGINS_TILES and can see that it gets included in the config at runtime, but somehow that did not help?

[dionhaefner]

I mean adding localhost to allowed origins, so the use case terracotta serve && terracotta connect always works. I wouldn’t allow all by default.

[chapmanjacobd]

yeah adding localhost by default makes a lot more sense than having no default since modern browsers seem to block localhost requests which have no CORS header set; at least in Firefox