From 56618473d1fbd2dca2ed5440d9f39cec077f2e2e Mon Sep 17 00:00:00 2001
From: Gabriel Adrian Samfira <gsamfira@cloudbasesolutions.com>
Date: Thu, 25 Sep 2025 13:35:47 +0000
Subject: [PATCH] Allow star CORS

If the user sets "*" as a CORS origin, allow everything.

Signed-off-by: Gabriel Adrian Samfira <gsamfira@cloudbasesolutions.com>
---
 apiserver/controllers/controllers.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/apiserver/controllers/controllers.go b/apiserver/controllers/controllers.go
index 019671eb..8c091443 100644
--- a/apiserver/controllers/controllers.go
+++ b/apiserver/controllers/controllers.go
@@ -58,6 +58,10 @@ func NewAPIController(r *runner.Runner, authenticator *auth.Authenticator, hub *
 				return false
 			}
 			for _, val := range apiCfg.CORSOrigins {
+				if val == "*" {
+					// user has a setting that allows everything
+					return true
+				}
 				corsVal, err := url.Parse(val)
 				if err != nil {
 					continue