INNER CODE UNIT · JavaScript
isAllowedOrigin
aeonfun/opendia · opendia-mcp/server.js:203
function isAllowedOrigin(origin) {
return !origin || EXTENSION_ORIGIN.test(origin);
}
// Never reflect `*`, or a page could read the response to a request it is
// allowed to send. Denying the origin only omits the header; the hard refusal is
// guardOrigin below, so a simple request that skips preflight is still blocked.
app.use(cors({
origin: (origin, callback) => callback(null, isAllowedOrigin(origin)),
allowedHeaders: ['Content-Type', 'Cache-Control', 'Authorization'],
methods: ['GET', 'POST', 'OPTIONS']
}));
function guardOrigin(req, res, next) {
const origin = req.headers.origin;
if (!isAllowedOrigin(origin)) {
console.error(`🚫 Rejected ${req.method} ${req.path} from origin ${origin}`);
return res.status(403).json({ error: 'Forbidden' });