Hi Rich,

  I think that would be a pretty easy enhancement.  The cors option could easily accept true, false, or a comma-separated list of https urls.  Do you program?  Perhaps you could make the change and submit a pull request on the ChimeraX github repository?   The two files that would need changing are 

https://github.com/RBVI/ChimeraX/blob/develop/src/bundles/rest_server/src/cmd.py

where the command option parsing would change from

from chimerax.core.commands import CmdDesc, IntArg, BoolArg

("cors", BoolArg),

to

from chimerax.core.commands import CmdDesc, IntArg, BoolArg, Or

("cors", Or(BoolArg, StringArg)),

and then in 

https://github.com/RBVI/ChimeraX/blob/develop/src/bundles/rest_server/src/server.py

where the _header() method lines would need to add some more Allow-Origin headers

        # Add CORS headers if enabled and origin is localhost
        if self.server.chimerax_restserver.cors:
            origin = self.headers.get("Origin")
            if _is_localhost_origin(origin):
                self.send_header("Access-Control-Allow-Origin", origin)
                self.send_header("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
                self.send_header("Access-Control-Allow-Headers", "Content-Type")

You could even just modify these two files directly in your ChimeraX distribution, for instance, on Mac in

ChimeraX.app/Contents/lib/python3.14/site-packages/chimerax/rest_server/

then restart ChimeraX, test it, and send me the two changed files.  The main reason I encourage you to do it is it will be some trouble for us to test the change, and you already have a realistic test case.

  If you don't program, I can make the changes if you are willing to test it.

Tom


On Aug 7, 2026, at 9:03 AM, Rich Waldo via ChimeraX-users <chimerax-users@cgl.ucsf.edu> wrote:

Hello! Thank you for the work you do making structural biology possible!

I was wondering if it would be possible to allow the remotecontrol rest start cors​ parameter to accept a list of allowed origins in addition to true​ (which I imagine would become an alias for http?://localhost:*,http?://127.0.0.1:*​) or false​. I have a browser extension I've written to make downloading volumes from CryoSPARC easier and I'd like to tell ChimeraX to first try opening the destination filename and only download the volume if that fails, but since my origin is not localhost I'm blocked by CORS and can't tell whether opening the volume succeeds or fails.
_______________________________________________
ChimeraX-users mailing list -- chimerax-users@cgl.ucsf.edu
To unsubscribe send an email to chimerax-users-leave@cgl.ucsf.edu
Archives: https://mail.cgl.ucsf.edu/mailman/archives/list/chimerax-users@cgl.ucsf.edu/