cors.py file-level

at sha256:a · View file ↗ · Intel ↗

History
1 files
1 commits
0 hotspots
0 🧊 dead
0 💥 blast risk
sha256:6 fix(ISR): default require_independent_second_reviewer to require Opera… · aaronrene · Sep 2, 2026
1 """CORS allowlist for hosted dashboard (§HGD.6.3)."""
2
3 from __future__ import annotations
4
5
6 def origin_allowed(origin: str | None, cors_origins: tuple[str, ...]) -> bool:
7 """Return whether Origin is allowed.
8
9 Missing Origin (same-origin / non-browser) is allowed.
10 When cors_origins is empty, any explicit Origin is denied (fail closed for
11 cross-origin) except missing Origin.
12 """
13 if origin is None or origin == "":
14 return True
15 return origin in cors_origins