Foreign origins are rejected before this runs. Reflect only the exact * same-server origin; a different localhost port is a different principal. */
| 98 | /* Foreign origins are rejected before this runs. Reflect only the exact |
| 99 | * same-server origin; a different localhost port is a different principal. */ |
| 100 | static void update_cors(const cbm_http_req_t *req, int port) { |
| 101 | if (req->origin[0] != '\0' && origin_is_same_server(req->origin, port)) { |
| 102 | snprintf(g_cors, sizeof(g_cors), |
| 103 | "Access-Control-Allow-Origin: %s\r\n" |
| 104 | "Access-Control-Allow-Methods: POST, GET, DELETE, OPTIONS\r\n" |
| 105 | "Access-Control-Allow-Headers: Content-Type\r\n", |
| 106 | req->origin); |
| 107 | } else { |
| 108 | /* No Access-Control-Allow-Origin → browser blocks cross-origin access */ |
| 109 | snprintf(g_cors, sizeof(g_cors), |
| 110 | "Access-Control-Allow-Methods: POST, GET, DELETE, OPTIONS\r\n" |
| 111 | "Access-Control-Allow-Headers: Content-Type\r\n"); |
| 112 | } |
| 113 | snprintf(g_cors_json, sizeof(g_cors_json), "%sContent-Type: application/json\r\n", g_cors); |
| 114 | } |
| 115 | |
| 116 | static const char *detect_ui_lang(const char *accept_language) { |
| 117 | if (accept_language && (strstr(accept_language, "zh-CN") || strstr(accept_language, "zh"))) { |
no test coverage detected