From a8b3641a9052d5e2fffdb747866438acf351ed51 Mon Sep 17 00:00:00 2001 From: Donkie Date: Fri, 31 Jul 2026 09:50:55 +0200 Subject: [PATCH] Document the two origin/host settings in .env.example The CORS example was schemeless (source1.domain.com:p1), which is not an origin and so never matches anything -- anyone following it got silent non-functionality. Adds SPOOLMAN_ALLOWED_HOSTS alongside it and points at the new wiki Security page. --- .env.example | 30 +++++++++++++++++++++++------- 1 file changed, 23 insertions(+), 7 deletions(-) diff --git a/.env.example b/.env.example index 6ce8403e..623302ca 100644 --- a/.env.example +++ b/.env.example @@ -84,10 +84,26 @@ SPOOLMAN_PORT=7912 #PUID=1000 #PGID=1000 -# Allows CORS ORIGIN. -# Use the https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Origin semantics -# separated by commas -# for example to allow request from source1.domain.com on port p1 and source2.domain.com on port p2 -# SPOOLMAN_CORS_ORIGIN=source1.domain.com:p1, source2.domain.com:p2 -# to allow from any -# SPOOLMAN_CORS_ORIGIN=* +# Extra browser origins allowed to talk to Spoolman, separated by commas. +# Only needed for a web UI served from a different address than Spoolman, such as a Fluidd or +# Mainsail instance on another host. Spoolman's own web UI does not need it, and neither does +# Moonraker, OctoPrint, Home Assistant or anything else that is not a browser. +# Each entry must include the scheme -- a bare "host:port" is not an origin and will never match. +# See https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Origin +#SPOOLMAN_CORS_ORIGIN=https://fluidd.local,http://mainsail.local:8080 +# To allow every origin. WARNING: this turns the origin checks off entirely, so any website you +# visit can read and modify your Spoolman data in the background. Only on a trusted network. +#SPOOLMAN_CORS_ORIGIN=* + +# Hostnames this Spoolman answers to, separated by commas. Off unless set. +# Protects against DNS rebinding, where a domain an attacker owns is pointed at your Spoolman's +# local address so that their web page can talk to it. Hostnames, not origins: no scheme, no port. +# "*.mydomain.com" covers the domain and its subdomains. +# IP addresses, single-word names, .local/.lan/.home/.home.arpa/.internal names and any hostname +# already in SPOOLMAN_CORS_ORIGIN keep working without being listed. +# If you reach Spoolman through a reverse proxy on a real domain, that domain must be listed here +# once this is set, or every request is refused with a 400. +#SPOOLMAN_ALLOWED_HOSTS=spoolman.mydomain.com + +# See the Security page in the wiki for how these two fit together: +# https://github.com/Donkie/Spoolman/wiki/Security