relay

The relay for sources the browser isn't allowed to read: a src or load on a site that sends no CORS header. The page asks /api/weft-relay?url=…, and this route fetches the URL and answers with what the site sent. See weft_data::relay.

It only forwards GETs to the origins the app's templates name (the list weft-build writes as weft_app::REMOTE_ORIGINS), and follows redirects only between them, so it can't be used to reach anywhere else.

pub fn configure(cfg: &mut ServiceConfig) {
    weft_api::relay::route(cfg, crate::weft_app::REMOTE_ORIGINS);
}