I've stumbled upon this question and had the thought that my application should not require CORS, since it is hosted on the same server (a raspberry pi).
However, since CORS is a security "feature" I'm also not sure if avoiding it would even be good or best practice. (I'm pretty sure it isn't)
My single page application is rather simple and dealing with CORS added a bit of complexity to it that seems unnecessary to a project of this scale.
The SPA is coded with VueJS and the backend API is a python Flask Server. VueJS is hosted using Nginx, api-calls to the flask server are made through uWsgi. CORS only popped up since the flask server sits on a different domain than the Frontend that sits in the browser. (from a network perspective)
As of now I haven't found a way to avoid CORS in my scenario, but when researching this it appears that configurations inside Nginx are the only way to approach this.
From my perspective, it is unnecessary to implement CORS. To explain, here is the concept of what the application does:
The frontend serves as a configuration, where board-type and the serial port is setup. Additionally there's also some customization to pin-names and pin's used in general.
For example:
BoardType: input Board IM8
Port: SER1
Pins: 2
pin1 -> input 3 - name: "I am input 3"
pin2 -> input 6 - name: "I am input 6"
This configuration is done on firepi.com/setup
Then when clicking on the Visualization link firepi.com/visualization
an interface is generated based on the setup.
Basically since it's an input board, 2 buttons are created which correspond to input 3 and input 6.
When the buttons are pressed, an ajax request to the Flask server is made, with the port & pin information. This will execute code on the flask server, which activates said pin on the attached board.
The flask server is hosted on the same device, just on a different port (5000): 127.0.0.1:5000
In all of this there's 2 types of API requests:
- is the /setup, where the board information is sent to the Flask server, so the GPIO's are configured properly. The configuration is needed because the board can be wired up in various ways.
- is the /visuals, where you can interact with the board pins that you have wired up.
Since the frontend and backend are both on the raspberry pi, I don't see a reason why CORS shouldn't be avoided.
I do however understand why it is required, since the browser executing the requests is a different domain than the hosted backend, which is on the RPi.
My question:
Am I able to avoid CORS in my scenario? And if so, should I do it?
What do I need to look into? Everything? Just Nginx configuration? Just Flask server? Maybe just how the server ports are setup?
I tried to avoid showing code in this question since I thought it will not be required to get answer it. Also it's a bit complicated to show all the code without explaining it.