Documentation
¶
Overview ¶
Package cors provides shared browser CORS origin normalization helpers.
Index ¶
Constants ¶
const DenyAllAllowlist = "https://invalid.invalid/lesser-cors-deny-all"
DenyAllAllowlist is a syntactically invalid origin-list sentinel used when an operator supplied only invalid origins. Runtime parsers ignore it and deploy templates never match it, preserving fail-closed behavior without falling back to the instance-origin default.
Variables ¶
This section is empty.
Functions ¶
func NormalizeAllowedOriginsForDeploy ¶
NormalizeAllowedOriginsForDeploy normalizes a comma-separated allowlist before it is embedded in deploy-time infrastructure. An empty raw value means "use the instance-origin default". A non-empty raw value with no valid entries returns DenyAllAllowlist so deploy-time preflights fail closed instead of accidentally reverting to the default origin.
func NormalizeOrigin ¶
NormalizeOrigin returns a normalized origin string and parsed URL when raw is exactly an origin. Paths other than '/', queries, fragments, opaque URLs, and userinfo are rejected.
func ParseAllowedOrigins ¶
ParseAllowedOrigins parses a comma-separated CORS allowlist for runtime use. Invalid entries are ignored fail-closed. A literal '*' is preserved only when explicitly supplied.
Types ¶
This section is empty.
Source Files