Monero: Add wildcard support to CORS Access-Control-Allow-Origin header in Daemon RPC

[woodser]

This issue requests wildcard support in the CORS Access-Control-Allow-Origin header in Daemon RPC. Doing so would allow web apps to query a Monero daemon to enable fully client-side web wallets. Since the daemon is a neutral provider of information about the Monero blockchain, I see no reason for it to discriminate against clients by not allowing web clients.

[woodser]

Related: #2408, #1677

[ph4r05]

Good idea if there is a command line switch and it is off by default (As mentioned on IRC).
Otherwise public nodes could be easily DDoSed by malicious websites (e.g., XSS on popular website)

[vtnerd]

--rpc-access-control-origin is already an option, but there is no wildcard support. Is there some use cases where specifying the domain is too difficult, or.. ?

[woodser]

@vtnerd The use case is for a web wallet to choose from multiple publicly available daemons, no different from how Cake Wallet, etc work. I supppse the additional risk is websites may DoS a daemon, but all daemons do is serve publicly available information, and I don’t see why we should restrict daemon’s from doing that if they choose to.

[hundehausen]

I support this. We need wildcard support for web based wallets like monero-javascript wasm wallet.

[AlexAnarcho]

Would love to see this for more awesome browser based non-custodial Monero services!