cors.py
python
sha256:0e9549ec7b463911bc08b7d586dc320b1ac9b1f5c943ee7e3865dcc6cb0f6f83
chore(governance): sync handover+roadmap to 84db8c8 (drift:…
Human
1 day ago
| 1 | """CORS allowlist for hosted dashboard (§HGD.6.3).""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | |
| 6 | def origin_allowed(origin: str | None, cors_origins: tuple[str, ...]) -> bool: |
| 7 | """Return whether Origin is allowed. |
| 8 | |
| 9 | Missing Origin (same-origin / non-browser) is allowed. |
| 10 | When cors_origins is empty, any explicit Origin is denied (fail closed for |
| 11 | cross-origin) except missing Origin. |
| 12 | """ |
| 13 | if origin is None or origin == "": |
| 14 | return True |
| 15 | return origin in cors_origins |
File History
1 commit
sha256:6abcf1fa82a7a621ccbc945f19acdba5bc0db54569599404a1452fb4a096a199
fix(ISR): default require_independent_second_reviewer to require
Human
minor
⚠
1 day ago