How to enable/disable cors for file resources

[be-mevsane]

Hi everyone,

when trying to access resources such as images within a CanvasKit renderer based web application, it gets blocked.
Building the same web application using html renderer can freely access the image. This behaviour is also explained here
web-images.
While there are many resolved issues regarding CORS and http controllers, i'm not sure on how to configure CORS for the resources such that CanvasKit renderer can access them. The file_types section from the config file does not seem to suffice.

How would an approach look like if I wanted to enable/disable resources based on same origin or cross origin? E.g.:

• Enable CORS for mydomain.com/images/share.png
• Disable CORS(only enabled for same origin) for mydomain.com/images/dont_share.png
• Enable CORS for mydomain.com/videos/*
• Disable CORS (only enabled for same origin) for mydomain.com/files/*

If my formulation is misleading or confusing, please pardon my lack of deeper knowledge in this area. I can try to elaborate even further if required.

[an-tao]

You can use the "locations" option in the configuration file and apply different filters to different resource paths as needed.

[be-mevsane]

Oh, it was already built in. Apology for not paying more attention to the docs... Your suggestion worked!

Edit for completeness sake:
In addition to the filter from "locations" in the config, I also had to add a static file header via "app().setStaticFileHeaders()" for "Access-Control-Allow-Origin: originB" or just * instead of originB.
While the filter satisfied the browsers preflight request, it still expected that the actual GET response also contains the header "Access-Control-Allow-Origin".

Tank you again for the hint :)