Allow for easy configuration of CORS

[sreimond-eodc]

Hello,
in the Tips and Tricks section of the stac-fastapi documentation it is described how to get stac-fastapi working with CORS requests.
I would like to control this easily using the stac-fastapi-pgstac docker compose file, for instance via environment variables. The only way to make this work currently is to clone the repo and edit the app.py myself - or am I missing something?
Thanks!

[m-mohr]

I'm also wondering, why this is not the default? Fundamental tools in the STAC ecosystem such as STAC Browser need it. I'd propose to include CORS by default with an option to disable it. This shouldn't be backend-specific though, so seems more like an issue for stac-fastapi itself.

[vincentsarago]

I'm also wondering, why this is not the default?

I believe it is https://github.com/stac-utils/stac-fastapi/blob/cae227840ee231ecfdb9b4ef1d187142dfe534ce/stac_fastapi/api/stac_fastapi/api/middleware.py#L21-L31

The CORS middleware is defined in https://github.com/stac-utils/stac-fastapi/blob/main/stac_fastapi/api/stac_fastapi/api/app.py#L111-L115 and this is going to be updated once stac-utils/stac-fastapi#442 gets merged for 3.0.

Sadly I don't see an easy way to support using environment variable for setting CORS options but it should be fairly simple for you to right a really lightweight custom app.py with your wanted configuration

see https://github.com/developmentseed/eoAPI/blob/main/runtime/eoapi/stac/eoapi/stac/app.py#L56-L78

[m-mohr]

Then I'd opt to enable it by default. What are the reasons for not having it by default?

[vincentsarago]

CORS is enabled by default, just not configurable

https://stac-utils.github.io/stac-fastapi/tips-and-tricks/#get-stac-fastapi-working-with-cors

[m-mohr]

The link you are referring to reads as if it's not enabled by default, thus my confusion:

For example, if you are running stac-browser to browse the STAC catalog created by stac-fastapi, then you will need to enable CORS support.

[vincentsarago]

we do need to update the docs 😅

https://github.com/stac-utils/stac-fastapi/blob/main/stac_fastapi/api/stac_fastapi/api/app.py#L113-L121

CORSMiddleware is enabled by default, just but we default configurations https://github.com/stac-utils/stac-fastapi/blob/8235d919b3ab742838d628653f14a54ae694cfe6/stac_fastapi/api/stac_fastapi/api/middleware.py#L19-L32