From 785d52da3195236621d4852e11e0f2a420cd243e Mon Sep 17 00:00:00 2001 From: ginuerzh Date: Wed, 3 Jun 2026 21:14:47 +0800 Subject: [PATCH] feat(metrics): add CORS headers for browser-based metrics access Allow browser-based dashboards (e.g. Flutter web apps) to access the metrics endpoint by setting Access-Control-Allow-Origin: * and handling OPTIONS preflight requests. --- metrics/service/service.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/metrics/service/service.go b/metrics/service/service.go index b4f05a96..72dc1d52 100644 --- a/metrics/service/service.go +++ b/metrics/service/service.go @@ -65,6 +65,16 @@ func NewService(network, addr string, opts ...Option) (service.Service, error) { mux := http.NewServeMux() mux.Handle(options.path, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + // CORS headers for browser-based access (e.g. Flutter dashboard) + w.Header().Set("Access-Control-Allow-Origin", "*") + w.Header().Set("Access-Control-Allow-Methods", "GET, OPTIONS") + w.Header().Set("Access-Control-Allow-Headers", "*") + + if r.Method == http.MethodOptions { + w.WriteHeader(http.StatusNoContent) + return + } + if options.auther != nil { u, p, _ := r.BasicAuth() if _, ok := options.auther.Authenticate(r.Context(), u, p, auth.WithService("@metrics")); !ok {