fix: allow all origins in devMode

frontend/cli/cmd_serve.go

@@ -177,18 +177,19 @@ func (s *serveCommonConfig) run(
 		controllerAddresses = append(controllerAddresses, controllerBind)
 	}
 
-	for _, addr := range controllerAddresses {
-		// Add controller address to allow origins for console requests.
-		// The console is run on `localhost` so we replace 127.0.0.1 with localhost.
-		if addr.Hostname() == "127.0.0.1" {
-			addr.Host = "localhost" + ":" + addr.Port()
-		}
-		s.CommonConfig.AllowOrigins = append(s.CommonConfig.AllowOrigins, addr)
-	}
-
-	if devMode && len(s.CommonConfig.AllowHeaders) == 0 {
-		// Default to allowing all headers for console requests in local dev mode.
+	if devMode {
+		// Default to allowing all origins and headers for console requests in local dev mode.
+		s.CommonConfig.AllowOrigins = []*url.URL{{Scheme: "*", Host: "*"}}
 		s.CommonConfig.AllowHeaders = []string{"*"}
+	} else {
+		for _, addr := range controllerAddresses {
+			// Add controller address to allow origins for console requests.
+			// The console is run on `localhost` so we replace 127.0.0.1 with localhost.
+			if addr.Hostname() == "127.0.0.1" {
+				addr.Host = "localhost" + ":" + addr.Port()
+			}
+			s.CommonConfig.AllowOrigins = append(s.CommonConfig.AllowOrigins, addr)
+		}
 	}
 
 	provisionerAddresses := make([]*url.URL, 0, s.Provisioners)