CORS

​

Overview

​

Allowed Origins

​

Adding CORS to a New Edge Function

import { getCorsHeaders, isDisallowedOrigin } from './_cors.js';

export default async function handler(req) {
  const cors = getCorsHeaders(req);

  // 1. Block disallowed origins
  if (isDisallowedOrigin(req)) {
    return new Response(JSON.stringify({ error: 'Forbidden' }), {
      status: 403,
      headers: { 'Content-Type': 'application/json', ...cors },
    });
  }

  // 2. Handle preflight
  if (req.method === 'OPTIONS') {
    return new Response(null, { status: 204, headers: cors });
  }

  // 3. Spread cors into every response
  return new Response(JSON.stringify(data), {
    headers: { 'Content-Type': 'application/json', ...cors },
  });
}

1. Every response must include ...cors in its headers — including errors, rate-limit 429s, and 500s.
2. Preflight (OPTIONS) must return 204 with CORS headers and no body.
3. getCorsHeaders(req, methods) — pass a custom methods string if the endpoint supports more than GET, OPTIONS (e.g., 'POST, OPTIONS').

​

Sebuf Gateway (RPC Endpoints)

​

Adding a New Allowed Origin

1. Add a regex pattern to ALLOWED_ORIGIN_PATTERNS in both api/_cors.js and server/cors.ts.
2. Update the test in api/_cors.test.mjs.
3. If the origin is a new production subdomain, also add it to the Cloudflare R2 CORS rules (see MEMORY.md notes on R2 CORS in the repo root).

​

Allowed Headers

• Content-Type
• Authorization
• X-WorldMonitor-Key (API key for desktop/third-party access). See API Key Gating for key management details.
• X-Api-Key
• X-Widget-Key
• X-Pro-Key
• X-WorldMonitor-Desktop-Timestamp
• X-WorldMonitor-Desktop-Signature
• Idempotency-Key
• Mcp-Session-Id
• MCP-Protocol-Version
• Last-Event-ID

​

Railway Relay CORS