Ajax call to server issue

[simoncn]

An app such as the LUMIN app or the mscript program can send an HTTP POST request using a TCP/IP socket connection. There is no cross-origin check for this. The cross-origin check is made only by a web browser.

Having thought about this some more, it is my understanding that opening this up by adding 'Access-Control-Allow-Origin: *' would enable anyone to host a public web page that could invoke a local rescan for MinimServer if the web page knew (or could guess) the local IP address of the MinimServer instance. This could happen in the background without the user being aware and would also enable any other MinimServer command to be run by an attacker.