Function validateCorsConfig

packages/server/src/utils/XSS.ts:72–81

()

}

export function validateCorsConfig(): void {
    if (getAllowedCorsOrigins() === '*' && getAllowCredentials()) {
        logger.warn(
            '[CORS] Unsafe configuration detected: CORS_ORIGINS=* cannot be combined with ' +
                'CORS_ALLOW_CREDENTIALS=true. Access-Control-Allow-Credentials has been forced to false. ' +
                'To allow credentialed cross-origin requests, set CORS_ORIGINS to an explicit comma-separated ' +
                'list of trusted origins instead of *.'
        )
    }
}

export function getCorsOptions(): any {
    return (req: any, callback: (err: Error | null, options?: any) => void) => {