Added Headers to HTTPReply()
Access-Control-Allow-Origin: Access-Control-Allow-Headers:
Specify the origin with new command line option -rpcorigin defaults to localhost only.
These headers are needed for make RPC requests from a browser. More info: https://developer.mozilla.org/en/http_access_control
Use cases are apps such as https://chrome.google.com/webstore/detail/ablfbfgmgfoggdhhcnledndibdihggpb and a feature I would like to implement for https://blockchain.info/wallet/
I don't believe we want to deal with the potential of CSRF issues in the JSON API, not to mention that exposing the RPC port to the internet is currently a reliable way to get yourself robbed. (And I assume it would be almost as bad with the users browser acting as a proxy)
The RPC port doesn't need to be exposed to the internet. There are a number of ways to circumvent the same origin policy this just makes it easier for those with legitimate uses.
Yeah, I think these sort of things are more appropriate via a proxy
FYI this has been discussed at #23 and https://bitcointalk.org/index.php?topic=2672.0 before.
Apologies, feel free to close the request.