Allow CORS request

webssh/handler.py

@@ -43,7 +43,8 @@ class InvalidValueError(Exception):
 class MixinHandler(object):
 
     custom_headers = {
-        'Server': 'TornadoServer'
+        'Server': 'TornadoServer',
+        "Access-Control-Allow-Origin": "*"
     }
 
     def initialize(self):
@@ -326,6 +327,9 @@ class IndexHandler(MixinHandler, tornado.web.RequestHandler):
 
 class WsockHandler(MixinHandler, tornado.websocket.WebSocketHandler):
 
+    def check_origin(self, origin):
+        return True
+
     def initialize(self, loop):
         self.loop = loop
         self.worker_ref = None

webssh/settings.py

@@ -49,7 +49,7 @@ def get_app_settings(options):
         static_path=os.path.join(base_dir, 'webssh', 'static'),
         websocket_ping_interval=options.wpintvl,
         debug=options.debug,
-        xsrf_cookies=True
+        xsrf_cookies=False
     )
     return settings