File

mod_http (and dependent modules): Make CORS opt-in by default (fixes #1731) The same-origin policy enforced by browsers is a security measure that should only be turned off when it is safe to do so. It is safe to do so in Prosody's default modules, but people may load third-party modules that are unsafe. Therefore we have flipped the default, so that modules must explicitly opt in to having CORS headers added on their requests.

Thanks for your interest in contributing to the project!

There are many ways to contribute, such as helping improve the
documentation, reporting bugs, spreading the word or testing the latest
development version.

You can find more information on how to contribute at <https://prosody.im/doc/contributing>

See also the HACKERS and README files.