Function withCorsHeaders

apps/local/src/serve.ts:292–317

(
  req: Request,
  response: Response,
  allowedHosts: ReadonlySet<string>,
)

} as const;

const withCorsHeaders = (
  req: Request,
  response: Response,
  allowedHosts: ReadonlySet<string>,
): Response => {
  const origin = req.headers.get("origin");
  // Same-origin requests carry no Origin header — nothing to do. Cross-origin
  // requests only get credentialed CORS if their Origin is an allowed loopback
  // host; an arbitrary web page (e.g. https://evil.example) gets no ACAO, so
  // the browser blocks it reading the response even if it knew the token.
  if (!origin || !isAllowedOrigin(origin, allowedHosts)) return response;
  const headers = new Headers(response.headers);
  headers.set("access-control-allow-origin", origin);
  for (const [key, value] of Object.entries(corsHeaders)) headers.set(key, value);
  headers.set(
    "access-control-allow-headers",
    req.headers.get("access-control-request-headers") ??
      corsHeaders["access-control-allow-headers"],
  );
  headers.append("vary", "Origin");
  return new Response(response.body, {
    status: response.status,
    statusText: response.statusText,
    headers,
  });
};

const corsPreflightResponse = (req: Request, allowedHosts: ReadonlySet<string>): Response =>
  withCorsHeaders(req, new Response(null, { status: 204 }), allowedHosts);