RDX: Extensions should not do CORS

[mook-as]

Actual Behavior

We currently make CORS requests (HTTP OPTIONS) when extension UI makes XHR requests.

Steps to Reproduce

1. Run Rancher Desktop in dev mode (to get dev tools)
2. Install extension that makes XHR requests
3. Read the network logs

Result

CORS requests are made (with Origin of x-rd-extension://…).

Expected Behavior

For compatibility, it seems like we shouldn't be making CORS requests when the extension UI makes requests (to the wider internet, as in XHR).

Additional Information

No response

Rancher Desktop Version

1.18.0-54-gb0f0c47de

Rancher Desktop K8s Version

N/A

Which container engine are you using?

moby (docker cli)

What operating system are you using?

macOS

Operating System / Build Version

macOS Ventura 13.7.2

What CPU architecture are you using?

arm64 (Apple Silicon)

Linux only: what package format did you use to install Rancher Desktop?

None

Windows User Only

No response

[mook-as]

What I've found out so far:

• WebPreferences has a webSecurity field that turns off CORS.
• However, setting that to false also stops loading preload scripts, so that's not very useful.
• I have not been able to replicate this result in a dummy Electron app; it's something to do with RD specifically.