github/sim
1
0
Fork 0
mirror of https://github.com/simstudioai/sim.git synced 2026-01-10 15:38:00 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix(cors): allow workflow executions via API in the browser (#386)

Browse Source 
* updated CORS to allow workflow executions via API in the browser

* ack PR comment
This commit is contained in:
Waleed Latif
2025-05-20 19:12:35 -07:00
committed by GitHub
parent 33123c6361
commit 4cd80947bd
2 changed files with 34 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
apps/sim/app/api/workflows/[id]/execute/route.ts
View File

@@ -1,4 +1,4 @@
import { NextRequest } from 'next/server'
import { NextRequest, NextResponse } from 'next/server'
import { eq, sql } from 'drizzle-orm'
import { v4 as uuidv4 } from 'uuid'
import { z } from 'zod'
@@ -367,3 +367,16 @@ export async function POST(request: NextRequest, { params }: { params: Promise<{
)
}
}
export async function OPTIONS(request: NextRequest) {
return new NextResponse(null, {
status: 200,
headers: {
'Access-Control-Allow-Origin': '*',
'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
'Access-Control-Allow-Headers':
'Content-Type, X-API-Key, X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Date, X-Api-Version',
'Access-Control-Max-Age': '86400',
},
})
}

21
apps/sim/next.config.ts
View File

@@ -77,7 +77,26 @@ const nextConfig: NextConfig = {
{
key: 'Access-Control-Allow-Headers',
value:
'X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version',
'X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version, X-API-Key',
},
],
},
// For workflow execution API endpoints
{
source: '/api/workflows/:id/execute',
headers: [
{ key: 'Access-Control-Allow-Origin', value: '*' },
{ key: 'Access-Control-Allow-Methods', value: 'GET,POST,OPTIONS,PUT' },
{
key: 'Access-Control-Allow-Headers',
value:
'X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version, X-API-Key',
},
{ key: 'Cross-Origin-Embedder-Policy', value: 'unsafe-none' },
{ key: 'Cross-Origin-Opener-Policy', value: 'unsafe-none' },
{
key: 'Content-Security-Policy',
value: "default-src * 'unsafe-inline' 'unsafe-eval'; connect-src *;",
},
],
},