Add CORS headers to allow JavaScript applications direct access

[iconara]

As far as I can tell there is no option to enable CORS on the HTTP API. This means that it's not possible to write a JavaScript application that interacts with a Consul agent without also writing a backend for it to tunnel requests through, or making the Consul agent itself serve the application.

I can see how some would prefer not to have CORS enabled by default, but an option to enable it would be very welcome.

Here's an some examples of what I would use it for:

• We have dashboards that visualize metrics and statuses from some of our services. These are "static" JavaScript applications, just HTML, JS and CSS with no backends, which make them very easy to deploy, or run on your own machine, or wherever is convenient. Currently they need configuration that tells them where the services that they visualize are, but being able to load service endpoints from Consul would mean that they would only require the hostname of a single Consul agent to be able to discover everything else.
• We would also want to build custom visualizations of the data in Consul, for example a dashboard showing the status of all services, or all services with some tag, or other groupings. The Consul UI is a good start, but we have much more knowledge about the details of our system and can build visualizations that are specific to our needs.

Would it be possible to add an option to make the HTTP API set CORS headers?

[pearkes]

I agree, you should be able to configure what header to set here, keeping the current default of no header.

[armon]

Yeah this is a good idea, we can add this.

[iconara]

That's great! Do you need any help? I'm no Go coder, but if you need someone to test it just tell me when.

[ceh]

What about adding an object to the configuration which allows the headers to be specified in free form, e.g.:

  {
    "http_api_response_headers": {
        "Access-Control-Allow-Origin": "*",
        "X-XSS-Protection" "1; mode=block",
        "X-Frame-Options": "SAMEORIGIN"
    }
  }

Where each specified header is added as an HTTP header response field on all HTTP API endpoint responses.

I'll compose a proposal since this approach is trivial.