INNER CODE UNIT · TypeScript

allowed

harvard-edge/cs249r_book · interviews/staffml-vault-worker/src/index.ts:129

  const allowed = raw ? raw.split(",").map(s => s.trim()).filter(Boolean) : [];
  const base: Record<string, string> = {
    "Access-Control-Allow-Methods": "GET, OPTIONS",
    "Access-Control-Allow-Headers": "Content-Type, If-None-Match, X-Vault-Release",
    Vary: "Origin",
  };
  if (allowed.length === 0) return base;   // no ACAO header — deny by omission
  if (origin && allowed.includes(origin)) {
    base["Access-Control-Allow-Origin"] = origin;
  }
  // If origin didn't match, still emit no ACAO — browsers deny.
  return base;
}

function json(
  body: unknown,
  init: ResponseInit & {
    etag?: string;

View source record →