From 4502ed068de1f5cf5370a20d9e4ad6a022068a78 Mon Sep 17 00:00:00 2001 From: Jaime Gago Date: Wed, 9 Apr 2014 12:56:31 -0700 Subject: [PATCH] Update README.md Caveat about using "*" in CORS --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 44e38a45672..957854aa651 100644 --- a/README.md +++ b/README.md @@ -67,6 +67,7 @@ Header set Access-Control-Allow-Origin "*" Header set Access-Control-Allow-Methods "GET, OPTIONS" Header set Access-Control-Allow-Headers "origin, authorization, accept" ``` +Note that using "\*" leaves your graphite instance quite open so you might want to consider using "http://my.graphite-dom.ain" in place of "\*" If your Graphite web is proteced by basic authentication, you have to enable the HTTP verb OPTIONS, origin (no wildcards are allowed in this case) and add Access-Control-Allow-Credentials. This looks like the following for Apache: @@ -106,4 +107,4 @@ Clone repository: This software is based on the great log dashboard [kibana](https://github.com/elasticsearch/kibana). # License -Grafana is distributed under Apache 2.0 License. \ No newline at end of file +Grafana is distributed under Apache 2.0 License.