[Galene] CORS help needed

[Juliusz Chroboczek <jch@irif.fr>]

Hello,

The administrative interface currently doesn't provide any CORS headers.
This means tha people cannot access it from third-party web sites, they
need to either integrate their code into Galene or use native clients.

This is https://github.com/jech/galene/issues/226

Currently, Galene has a very primitive CORS configuration: either
publicServer is not set in the config file, in which case no CORS headers
are produced, or publicServer is set, in which case CORS headers (and the
equivalent for the WebSocket protocol) allow unrestricted access to both
the native protocol and the WHIP ingress protocol.

In either case, the administrative interface is not affected.

Questions to the experts:

  - should we be allowing CORS on the administrative interface, or is it
    a security risk?
  
  - should we have a single directive to control CORS, or should there be
    separate directives for audio/video and for administration?

  - shold it be a single boolean, as right now, or should the user be able
    to specify a specific domain?

My current understanding is:

  - we should allow CORS, but make it default to no;

  - we should have two distinct directives;

  - we shold allow specifying a domain, or even a small number of domains.

Thanks for your help,

-- Juliusz