The only thing you may want to consider if that this will allow external
website to bypass any sort of firewall that Eureka might be behind.

For example if the Eureka instance is behind a firewall someone couldn't
use curl, but they will be able to query this endpoint from JavaScript
since their code will be running within the firewall on the user's machine.

As long as you're ok with these resource being Public (as in to anyone in
the world) and not just public as in anonymous authentication within the
firewall then that's fine though.

On Mon Sep 23 2013 at 1:25:38 PM, Steve Terlecki <notifications@github.com>
wrote:

> In web/src/main/webapp/WEB-INF/web.xml:
>
> > @@ -75,7 +75,37 @@
> >  	</context-param>
> >
> >  	<!-- =============== FILTERS =============== -->
> > +	<!-- Add cors support to endpoint for reading avatars -->
> > +    <filter>
> > +        <filter-name>CORS</filter-name>
> > +        <filter-class>com.thetransactioncompany.cors.CORSFilter</filter-class>
> > +        <init-param>
> > +            <param-name>cors.allowOrigin</param-name>
> > +            <param-value>*</param-value>
>
> This is just a shortcut to allow browser access to public endpoints. The
> endpoints that you see later on in the config
> (/resources/util/singlePersonProperties/* and /eurekastreams/*) are already
> publicly accessible (Anonymous authentication) within eureka. Those
> endpoints could be accessed directly from a non-browser based http tool
> (wget, curl) right now.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/lmco/eurekastreams/pull/225/files#r6521019>
> .
>