INNER CODE UNIT · JavaScript

EXTENSION_ORIGIN

aeonfun/opendia · opendia-mcp/server.js:201

const EXTENSION_ORIGIN = /^(chrome|moz|safari-web)-extension:\/\//;

function isAllowedOrigin(origin) {
  return !origin || EXTENSION_ORIGIN.test(origin);
}

// Never reflect `*`, or a page could read the response to a request it is
// allowed to send. Denying the origin only omits the header; the hard refusal is
// guardOrigin below, so a simple request that skips preflight is still blocked.
app.use(cors({
  origin: (origin, callback) => callback(null, isAllowedOrigin(origin)),
  allowedHeaders: ['Content-Type', 'Cache-Control', 'Authorization'],
  methods: ['GET', 'POST', 'OPTIONS']
}));

function guardOrigin(req, res, next) {
  const origin = req.headers.origin;
  if (!isAllowedOrigin(origin)) {

View source record →