From 8041d2906cd02b64564423c3f97fe3b95f39a60a Mon Sep 17 00:00:00 2001 From: YueGuobin Date: Tue, 7 Apr 2026 20:22:15 +0800 Subject: [PATCH] fix(symbols): add CORS headers to symbol file responses FileResponse does not properly include CORS headers when served from a different origin. This fix manually adds the Access-Control-Allow-Origin header based on the request origin. Fixes CORS policy errors when accessing symbol files from frontend applications running on localhost:4200 or other origins. --- gns3server/api/routes/controller/symbols.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/gns3server/api/routes/controller/symbols.py b/gns3server/api/routes/controller/symbols.py index 9701c97ea..7b9e40646 100644 --- a/gns3server/api/routes/controller/symbols.py +++ b/gns3server/api/routes/controller/symbols.py @@ -61,7 +61,7 @@ def get_symbols() -> List[dict]: # FIXME: this is a temporary workaround due to a bug in the web-ui: https://github.com/GNS3/gns3-web-ui/issues/1466 # dependencies=[Depends(has_privilege("Symbol.Audit"))] ) -async def get_symbol(symbol_id: str) -> FileResponse: +async def get_symbol(symbol_id: str, request: Request) -> Response: """ Download a symbol file. @@ -71,7 +71,12 @@ async def get_symbol(symbol_id: str) -> FileResponse: controller = Controller.instance() try: symbol = controller.symbols.get_path(symbol_id) - return FileResponse(symbol) + return FileResponse( + symbol, + headers={ + "Access-Control-Allow-Origin": request.headers.get("origin", "*"), + } + ) except (KeyError, OSError) as e: raise ControllerNotFoundError(f"Could not get symbol file: {e}")