Documentation
¶
Overview ¶
Package corsutil centralizes the CORS policy for endpoints that historically sent `Access-Control-Allow-Origin: *` (OAuth, proxy metadata, plugin assets). The policy is configured via CORS_ALLOWED_ORIGINS:
- unset (default) or "*": wildcard, preserving existing behavior
- comma-separated origins: the request Origin is echoed back only when it matches an entry (case-insensitive); otherwise no CORS header is sent
Credentials are never enabled by this package.
Index ¶
Constants ¶
const DefaultAllowHeaders = "Origin, Content-Type, Accept, Authorization"
DefaultAllowHeaders is the Access-Control-Allow-Headers value used by SetCORSHeaders.
const EnvAllowedOrigins = "CORS_ALLOWED_ORIGINS"
EnvAllowedOrigins configures the allowed origins for the endpoints that previously used a wildcard CORS policy.
Variables ¶
This section is empty.
Functions ¶
func AllowOrigin ¶
AllowOrigin returns the value to send as Access-Control-Allow-Origin for a request with the given Origin header, and whether an explicit origin list is configured (callers should send `Vary: Origin` when it is). An empty returned origin means the header must be omitted.
func SetAllowedOrigins ¶
func SetAllowedOrigins(origins string)
SetAllowedOrigins sets the comma-separated origin list (Studio passes AppConf.CORSAllowedOrigins); without it, CORS_ALLOWED_ORIGINS decides. An empty list allows any origin.
func SetCORSHeaders ¶
SetCORSHeaders applies the CORS policy to a response header set. methods is the value for Access-Control-Allow-Methods.
func SetCORSHeadersFor ¶
SetCORSHeadersFor applies the CORS policy with explicit allowed and exposed header lists. Protocols carried over HTTP need more than the default set: MCP's StreamableHTTP transport sends Mcp-Session-Id and MCP-Protocol-Version on requests and returns Mcp-Session-Id, which a browser client cannot read unless it is exposed. exposeHeaders may be empty.
Types ¶
This section is empty.
Source Files