Skip to content

HTTPS & CORS

This page covers general server settings including HTTPS/TLS and CORS.

HTTPS / TLS ≥0.1.0

Aspected supports HTTPS with TLS certificates. To enable it, provide paths to your certificate and private key files ( PEM format):

config.yml
server:
  https:
    enabled: true
    certificatePath: /path/to/cert.pem
    privateKeyPath: /path/to/key.pem

Or via environment variables:

export ASPECTED_SERVER_HTTPS_ENABLED=true
export ASPECTED_SERVER_HTTPS_CERTIFICATE_PATH=/path/to/cert.pem
export ASPECTED_SERVER_HTTPS_PRIVATE_KEY_PATH=/path/to/key.pem

Enable HTTPS when using authentication

If you are exposing Aspected directly to the internet with authentication enabled, you must enable HTTPS. Without TLS, tokens are sent in plain text over the network and can be easily intercepted.

Always use HTTPS in production environments where the server is reachable from untrusted networks.

CORS ≥0.2.0

Default CORS behavior is same-origin only. To enable CORS set the server.corsEnabled configuration option:

config.yml
server:
  corsEnabled: true

Or via an environment variable:

export ASPECTED_SERVER_CORS_ENABLED=true