aaronrene / overseer-kit public
cors.py python
15 lines 494 B
Raw
sha256:106ef9e12cca7f3be3ffb2a6bd3abfa76f032dce453c9e5010d732a8d86f2e14 Reconcile reviewed credential compatibility 32254cd939885d9… Human patch 8 days ago
1 """CORS allowlist for hosted dashboard (§HGD.6.3)."""
2
3 from __future__ import annotations
4
5
6 def origin_allowed(origin: str | None, cors_origins: tuple[str, ...]) -> bool:
7 """Return whether Origin is allowed.
8
9 Missing Origin (same-origin / non-browser) is allowed.
10 When cors_origins is empty, any explicit Origin is denied (fail closed for
11 cross-origin) except missing Origin.
12 """
13 if origin is None or origin == "":
14 return True
15 return origin in cors_origins
File History 2 commits
sha256:106ef9e12cca7f3be3ffb2a6bd3abfa76f032dce453c9e5010d732a8d86f2e14 Reconcile reviewed credential compatibility 32254cd939885d9… Human patch 8 days ago
sha256:c87cf2c2f03da507f66f93922cb339a2cbebb33ad6372a6039032fb09a20da12 Reconcile reviewed Overseer recovery d47291d5d9030de5ebef71… Human minor ⚠ 8 days ago