INNER CODE UNIT · TypeScript
corsHeaders
harvard-edge/cs249r_book · interviews/staffml-vault-worker/src/index.ts:124
function corsHeaders(env: Env, origin: string | null): Record<string, string> {
// Fail-closed on empty/missing env var (Chip R4-H-2): a misconfigured
// deploy that blanked CORS_ALLOWLIST must NOT silently flip to wildcard.
// Emit no Access-Control-Allow-Origin header; browsers enforce deny.
const raw = (env.CORS_ALLOWLIST || "").trim();
const allowed = raw ? raw.split(",").map(s => s.trim()).filter(Boolean) : [];
const base: Record<string, string> = {
"Access-Control-Allow-Methods": "GET, OPTIONS",
"Access-Control-Allow-Headers": "Content-Type, If-None-Match, X-Vault-Release",
Vary: "Origin",
};
if (allowed.length === 0) return base; // no ACAO header — deny by omission
if (origin && allowed.includes(origin)) {
base["Access-Control-Allow-Origin"] = origin;
}
// If origin didn't match, still emit no ACAO — browsers deny.
return base;
}