env var for controling allowed origins ?

Hi,

We have a scenario were we want to use table data from within another application (a map) served from another domain than our Grist domain.

I’ve first tried to add CORS headers in the Treafik proxy, but then I hit a check in grist-core. So I’ve discovered that there is a small CORS management in Grist, great! 😃

I understand that the API keys are “full powered” at this time, so exposing them in an application may be quite risky. But it seems that if the document is “public access: on”, we can get the data through the API without a key (not totally sure about this point, though).

So, a suggestion would be to add an (optional) env var GRIST_ALLOWED_HOSTS to allow more hosts.

Does that make sense ?

Thanks for your inputs,

Yohan

cc @LouisDelbosc

[paulfitz]

The ability to set a list of allowed origins on a per-document basis would definitely be useful, and Document Settings would be a good place for it. For self-managed Grist, an optional GRIST_ALLOWED_HOSTS environment variable that enumerates a set of trusted sites associated with the entire installation also makes sense. Since the environment variable is much easier to implement, and an immediate need for you, I agree @LouisDelbosc that it is a good place to start.

I think it would be helpful if the environment variable functioned like the existing ALLOWED_WEBHOOK_DOMAINS variable, which is a comma-separated list of domains that may be used in webhooks (e.g. webhook.site,zapier.com). In that case, subdomains of the listed domains are permitted, and I think that would be desirable here too for consistency.

[dsagal]

It would be nice setting a list of allowed origins on a per-document basis.

It would allow things like adding a record to Grist (including hosted Grist) directly from a form on a webpage (using some Javascript). There is a risk that it would tempt people to put sensitive API keys into pages, which we should discourage as much as possible. But it would be legitimately useful for unauthenticated requests, since you could make a Grist document public and use granular access rules to limit what unauthenticated requests can do.