httpStatic files do not seem to use httpNodeCors settings?

General
1

I have the latest version of node-red v3.x set up with these settings:

httpAdminRoot: "/admin",
httpNodeRoot: "/red",
httpStatic: "/opt/nodered/static",

and I am able to retrieve the static files using my browser. However, when I try to pull those same urls into observablehq.com as data, I am getting CORS errors....

So I added this setting in hopes it would apply to my static file urls:

httpNodeCors: {
    origin: "*",
    methods: "GET"
}

which does not help, since the static urls are not being handled via http in endpoints, I guess, which kinda makes sense. So is there built-in way to disable CORS for static files? Or does this require custom middleware???

2

Please raise an issue - it would make sense for that setting to get applied to httpStatic.

3

Ok, well that answers that question -- thanks Nick.
Although now I'm wondering if static routes will need their own configuration, to support public access that is not as strict as http node routes. :thinking:

Issue raised... 4759

4

Looks like this feature has been added to v4.x -- many thanks, Nick!