Hello! Thank you for the work you do making structural biology possible! I was wondering if it would be possible to allow the remotecontrol rest start cors parameter to accept a list of allowed origins in addition to true (which I imagine would become an alias for http?://localhost:*,http?://127.0.0.1:*) or false. I have a browser extension I've written to make downloading volumes from CryoSPARC easier and I'd like to tell ChimeraX to first try opening the destination filename and only download the volume if that fails, but since my origin is not localhost I'm blocked by CORS and can't tell whether opening the volume succeeds or fails.
Hi Rich, I think that would be a pretty easy enhancement. The cors option could easily accept true, false, or a comma-separated list of https urls. Do you program? Perhaps you could make the change and submit a pull request on the ChimeraX github repository? The two files that would need changing are https://github.com/RBVI/ChimeraX/blob/develop/src/bundles/rest_server/src/cm... where the command option parsing would change from from chimerax.core.commands import CmdDesc, IntArg, BoolArg ("cors", BoolArg), to from chimerax.core.commands import CmdDesc, IntArg, BoolArg, Or ("cors", Or(BoolArg, StringArg)), and then in https://github.com/RBVI/ChimeraX/blob/develop/src/bundles/rest_server/src/se... where the _header() method lines would need to add some more Allow-Origin headers # Add CORS headers if enabled and origin is localhost if self.server.chimerax_restserver.cors: origin = self.headers.get("Origin") if _is_localhost_origin(origin): self.send_header("Access-Control-Allow-Origin", origin) self.send_header("Access-Control-Allow-Methods", "GET, POST, OPTIONS") self.send_header("Access-Control-Allow-Headers", "Content-Type") You could even just modify these two files directly in your ChimeraX distribution, for instance, on Mac in ChimeraX.app/Contents/lib/python3.14/site-packages/chimerax/rest_server/ then restart ChimeraX, test it, and send me the two changed files. The main reason I encourage you to do it is it will be some trouble for us to test the change, and you already have a realistic test case. If you don't program, I can make the changes if you are willing to test it. Tom
On Aug 7, 2026, at 9:03 AM, Rich Waldo via ChimeraX-users <chimerax-users@cgl.ucsf.edu> wrote:
Hello! Thank you for the work you do making structural biology possible!
I was wondering if it would be possible to allow the remotecontrol rest start cors parameter to accept a list of allowed origins in addition to true (which I imagine would become an alias for http?://localhost:*,http?://127.0.0.1:*) or false. I have a browser extension I've written to make downloading volumes from CryoSPARC easier and I'd like to tell ChimeraX to first try opening the destination filename and only download the volume if that fails, but since my origin is not localhost I'm blocked by CORS and can't tell whether opening the volume succeeds or fails. _______________________________________________ ChimeraX-users mailing list -- chimerax-users@cgl.ucsf.edu To unsubscribe send an email to chimerax-users-leave@cgl.ucsf.edu Archives: https://mail.cgl.ucsf.edu/mailman/archives/list/chimerax-users@cgl.ucsf.edu/
Happy to, I didn't know if this would require a full build but if it's just a few python files I'll submit a PR once I have a moment! Thanks! -Rich On Friday, August 7th, 2026 at 11:26 AM, Tom Goddard <goddard@sonic.net> wrote:
Hi Rich,
I think that would be a pretty easy enhancement. The cors option could easily accept true, false, or a comma-separated list of https urls. Do you program? Perhaps you could make the change and submit a pull request on the ChimeraX github repository? The two files that would need changing are
https://github.com/RBVI/ChimeraX/blob/develop/src/bundles/rest_server/src/cm...
where the command option parsing would change from
from chimerax.core.commands import CmdDesc, IntArg, BoolArg
("cors", BoolArg),
to
from chimerax.core.commands import CmdDesc, IntArg, BoolArg, Or
("cors", Or(BoolArg, StringArg)),
and then in
https://github.com/RBVI/ChimeraX/blob/develop/src/bundles/rest_server/src/se...
where the _header() method lines would need to add some more Allow-Origin headers
# Add CORS headers if enabled and origin is localhost if self.server.chimerax_restserver.cors: origin = self.headers.get("Origin") if _is_localhost_origin(origin): self.send_header("Access-Control-Allow-Origin", origin) self.send_header("Access-Control-Allow-Methods", "GET, POST, OPTIONS") self.send_header("Access-Control-Allow-Headers", "Content-Type")
You could even just modify these two files directly in your ChimeraX distribution, for instance, on Mac in
ChimeraX.app/Contents/lib/python3.14/site-packages/chimerax/rest_server/
then restart ChimeraX, test it, and send me the two changed files. The main reason I encourage you to do it is it will be some trouble for us to test the change, and you already have a realistic test case.
If you don't program, I can make the changes if you are willing to test it.
Tom
On Aug 7, 2026, at 9:03 AM, Rich Waldo via ChimeraX-users <chimerax-users@cgl.ucsf.edu> wrote:
Hello! Thank you for the work you do making structural biology possible!
I was wondering if it would be possible to allow the remotecontrol rest start cors parameter to accept a list of allowed origins in addition to true (which I imagine would become an alias for http?://localhost:*,http?://127.0.0.1:*) or false. I have a browser extension I've written to make downloading volumes from CryoSPARC easier and I'd like to tell ChimeraX to first try opening the destination filename and only download the volume if that fails, but since my origin is not localhost I'm blocked by CORS and can't tell whether opening the volume succeeds or fails.
_______________________________________________ ChimeraX-users mailing list -- chimerax-users@cgl.ucsf.edu To unsubscribe send an email to chimerax-users-leave@cgl.ucsf.edu Archives: https://mail.cgl.ucsf.edu/mailman/archives/list/chimerax-users@cgl.ucsf.edu/
participants (2)
-
Rich Waldo -
Tom Goddard