Restore CORS support to CORS proxy

[brandonpayton]

Motivation for the change, related issues

We want to move the CORS proxy to a separate host from playground.wordpress.net. In order to continue using the proxy from playground.wordpress.net, the CORS proxy needs to support cross-origin requests to itself.

Implementation details

This PR updates the CORS proxy to again respond with CORS-related headers for supported origins. Currently, supported origins are "https://playground.wordpress.net" and local origins based on "127.0.0.1" and "localhost".

Testing Instructions (or ideally a Blueprint)

• Once Add deploy workflow for standalone CORS proxy #2022 is merged, deploy this branch to the dedicated CORS proxy host.
• Create a Blueprint that uses the dedicated CORS proxy host.
• Confirm the Blueprint works with playground.wordpress.net.
• Confirm the Blueprint works with the local dev server.

[adamziel]

Should we also refuse to serve requests coming from playground.wordpress.net?

[brandonpayton]

@adamziel do you mean requests from the current playground.wordpress.net proxy server to the dedicated proxy server?

Maybe it would be good for us to send a custom user agent like WordPressPlaygroundCorsProxy. We could deny all requests with the WordPressPlaygroundCorsProxy user agent. And it would probably be good to be as forthright as possible with the target servers about the nature of our requests.

Maybe we can make this a configurable header and only set it for the proxy deployed to WP cloud. That way, folks deploying their own instances of the proxy (which won't have most of the defensive meaures) won't send that user agent by default.

Either way, I think that can come as a separate PR.

What do you think?

[adamziel]

I meant making sure we can't request https://playground.wordpress.net/cors-proxy.php – mu assumption was that the script would still be colocated with the website deployment, which may not be true at all.

Maybe it would be good for us to send a custom user agent like WordPressPlaygroundCorsProxy.

My worry is that it would likely trigger security mechanisms on more than few servers and, e.g., filter out our IP or display a ddos protection screen.