cors.py
file-level
1
files
1
commits
0
hotspots
0
🧊 dead
0
💥 blast risk
| 1 | """CORS allowlist for hosted dashboard (§HGD.6.3).""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | |
| 6 | def origin_allowed(origin: str | None, cors_origins: tuple[str, ...]) -> bool: |
| 7 | """Return whether Origin is allowed. |
| 8 | |
| 9 | Missing Origin (same-origin / non-browser) is allowed. |
| 10 | When cors_origins is empty, any explicit Origin is denied (fail closed for |
| 11 | cross-origin) except missing Origin. |
| 12 | """ |
| 13 | if origin is None or origin == "": |
| 14 | return True |
| 15 | return origin in cors_origins |