cors.py
python
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1
docs: MuseHub-first before ISR #74 — staging solidify NEXT
Human
1 day ago
| 1 | """CORS allowlist for hosted dashboard (§HGD.6.3).""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | |
| 6 | def origin_allowed(origin: str | None, cors_origins: tuple[str, ...]) -> bool: |
| 7 | """Return whether Origin is allowed. |
| 8 | |
| 9 | Missing Origin (same-origin / non-browser) is allowed. |
| 10 | When cors_origins is empty, any explicit Origin is denied (fail closed for |
| 11 | cross-origin) except missing Origin. |
| 12 | """ |
| 13 | if origin is None or origin == "": |
| 14 | return True |
| 15 | return origin in cors_origins |
File History
1 commit
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1
docs: MuseHub-first before ISR #74 — staging solidify NEXT
Human
1 day ago