Paul Picazo and Claude Opus 5.5
d66a219bcb
feat(cors): let a UI on another origin connect, static host previews included ( #2362 )
...
## What this does
Server changes so the UI can be served from another origin, such as a
Cloudflare Pages project and its previews, against an existing backend.
It ships before the frontend, which is parked on
[`backup/static-frontend-1a`](https://github.com/ppicazo/CoreScope/tree/backup/static-frontend-1a )
and will come as its own PR.
- **Exposed headers:** allowed origins get
`Access-Control-Expose-Headers: Retry-After, X-CoreScope-Load-Status`.
The UI reads both, and cross-origin they are `null` without this.
- **Wildcard origins:** an entry may be `scheme://*.host[:port]`, such
as `https://*.myproject.pages.dev `. It matches exactly one leftmost
label (each deploy and branch preview) for both CORS and `/ws`, but not
`myproject.pages.dev` itself. The part after `*.` needs at least three
labels, so `*.pages.dev` is refused. Refused or malformed wildcards are
dropped at startup with a log line. That floor is a sanity check, not a
Public Suffix List lookup: `https://*.s3.amazonaws.com ` passes and would
admit every S3 website endpoint, so a wildcard belongs only over a host
the operator controls.
- **Case:** exact entries now match case-insensitively for CORS (was
`==`), as they already did for `/ws`.
- **Test only:** pins that the three anonymous POSTs (`/api/decode`,
`/api/packets/observations`, `/api/paths/inspect`) accept a `text/plain`
JSON body, which keeps them free of a preflight.
Credentials stay off, so nothing a listed origin sends rides on cookies.
Beyond GET, a listed origin, and so every deployment under a wildcard
entry, can:
- call those three anonymous POSTs as simple requests. That predates
this PR; they compute an answer and write nothing.
`Access-Control-Allow-Methods: GET, HEAD, OPTIONS` only governs
preflighted requests.
- with `userManagement.enabled`, use the existing bearer tier for
companion linking (`/api/auth/device-token`, `/api/auth/me`,
`/api/auth/logout`, `/api/account/settings`, `/api/account/companions*`)
with POST, PUT and DELETE. Those routes need a device token in
`Authorization`, not a cookie, but a preview deployment gets them too.
On such a server, list a wildcard only if previews may use them.
## Configuring
```yaml
- CORS_ALLOWED_ORIGINS=https://existing-embed.example,https://myproject.pages.dev,https://*.myproject.pages.dev
```
The env var replaces `corsAllowedOrigins`, so keep the origins already
listed there.
## Testing
- `go test ./...`, `go vet` and `gofmt` are clean in `cmd/server`. The
new tests were written first and failed first.
- In Chromium, the static build from the backup branch, served on
`pr-1.proj.preview.localhost`, passed its split E2E (9/9, WebSocket
included) against this server.
- From the same setup, the project origin connected, a two-level
subdomain was blocked, and `X-CoreScope-Load-Status` read `ready` where
master gives `null`.
## Performance
These run per request in the CORS middleware and the `/ws` handshake,
and they allocate nothing. Same-origin requests skip them.
🤖 Generated with [Claude Code](https://claude.com/claude-code )
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com >
2026-11-08 17:46:17 +01:00
..
2026-04-21 09:09:39 -07:00
2026-10-10 18:20:49 +02:00
2026-10-08 22:16:49 +02:00
2026-10-26 09:50:20 +01:00
2026-10-26 09:50:20 +01:00
2026-10-07 09:25:29 +02:00
2026-10-26 15:42:01 +01:00
2026-10-22 21:20:42 +02:00
2026-10-08 21:38:30 +02:00
2026-10-08 21:38:30 +02:00
2026-10-10 18:20:49 +02:00
2026-10-08 22:02:39 +02:00
2026-10-08 21:38:30 +02:00
2026-10-26 09:50:20 +01:00
2026-10-08 21:38:30 +02:00
2026-10-03 12:16:55 +02:00
2026-04-03 13:51:13 -07:00
2026-10-26 15:42:01 +01:00
2026-10-03 12:16:55 +02:00
2026-10-03 12:16:55 +02:00
2026-10-03 12:16:55 +02:00
2026-10-11 09:51:48 +02:00
2026-09-22 07:55:37 +02:00
2026-05-21 14:00:15 -07:00
2026-10-11 09:51:48 +02:00
2026-09-13 19:59:37 +02:00
2026-09-13 19:59:37 +02:00
2026-09-04 16:02:59 +02:00
2026-10-17 11:46:18 +02:00
2026-10-07 09:25:29 +02:00
2026-10-08 22:02:39 +02:00
2026-10-08 22:02:39 +02:00
2026-10-08 21:38:30 +02:00
2026-10-07 09:25:29 +02:00
2026-10-20 14:53:26 +02:00
2026-10-10 18:08:51 +02:00
2026-10-08 21:38:30 +02:00
2026-10-08 22:02:39 +02:00
2026-10-26 09:50:20 +01:00
2026-10-07 09:25:29 +02:00
2026-10-07 11:20:44 +02:00
2026-10-20 14:53:26 +02:00
2026-10-26 09:50:20 +01:00
2026-10-28 19:10:41 +01:00
2026-10-10 18:20:49 +02:00
2026-10-10 18:20:49 +02:00
2026-05-03 17:56:42 -07:00
2026-05-03 17:56:42 -07:00
2026-10-10 18:20:49 +02:00
2026-10-08 16:26:10 +02:00
2026-09-16 09:02:13 +02:00
2026-05-18 22:51:23 -07:00
2026-05-18 22:51:23 -07:00
2026-05-18 22:51:23 -07:00
2026-10-26 15:42:29 +01:00
2026-10-17 11:46:18 +02:00
2026-06-04 03:21:26 -07:00
2026-09-03 18:52:03 +02:00
2026-10-09 19:58:42 +02:00
2026-10-09 19:58:42 +02:00
2026-06-04 13:14:09 +00:00
2026-09-03 18:52:03 +02:00
2026-10-26 15:42:01 +01:00
2026-10-29 18:33:59 +01:00
2026-10-29 18:33:59 +01:00
2026-10-26 15:42:01 +01:00
2026-10-29 18:33:59 +01:00
2026-10-29 18:33:59 +01:00
2026-10-17 11:46:18 +02:00
2026-04-20 21:46:34 -07:00
2026-10-05 20:32:40 +02:00
2026-09-13 20:36:34 +02:00
2026-09-03 18:52:03 +02:00
2026-05-25 22:16:14 -07:00
2026-06-07 03:43:29 -07:00
2026-09-16 09:02:13 +02:00
2026-09-16 09:02:13 +02:00
2026-09-03 18:52:03 +02:00
2026-10-26 15:42:01 +01:00
2026-06-03 13:58:04 -07:00
2026-06-06 22:45:05 -07:00
2026-10-26 09:50:20 +01:00
2026-10-21 15:17:58 +02:00
2026-10-21 15:17:58 +02:00
2026-09-02 09:50:18 +02:00
2026-09-03 18:52:03 +02:00
2026-09-02 09:50:18 +02:00
2026-05-18 12:27:44 -07:00
2026-09-03 18:52:03 +02:00
2026-09-13 19:59:37 +02:00
2026-05-21 14:00:15 -07:00
2026-10-10 18:20:49 +02:00
2026-10-10 18:20:49 +02:00
2026-10-10 18:20:49 +02:00
2026-10-10 18:20:49 +02:00
2026-05-21 11:39:49 -07:00
2026-05-21 11:39:49 -07:00
2026-05-21 11:39:49 -07:00
2026-09-03 18:52:03 +02:00
2026-10-10 21:20:40 +02:00
2026-10-13 08:44:49 +02:00
2026-10-13 08:44:49 +02:00
2026-10-13 08:44:49 +02:00
2026-10-13 08:44:49 +02:00
2026-06-06 22:45:05 -07:00
2026-11-08 17:46:17 +01:00
2026-10-10 18:20:49 +02:00
2026-05-30 13:22:41 -07:00
2026-11-08 17:46:17 +01:00
2026-05-30 13:22:41 -07:00
2026-11-08 17:46:17 +01:00
2026-11-08 17:46:17 +01:00
2026-06-19 11:37:16 -07:00
2026-06-27 22:03:05 -07:00
2026-10-26 15:42:29 +01:00
2026-10-17 11:46:18 +02:00
2026-06-04 14:41:00 -07:00
2026-09-02 13:10:43 +00:00
2026-09-23 10:05:59 +02:00
2026-10-26 15:42:01 +01:00
2026-10-29 18:34:06 +01:00
2026-10-15 10:30:28 +02:00
2026-06-12 19:10:44 -07:00
2026-05-15 22:34:21 -07:00
2026-09-03 18:52:03 +02:00
2026-09-03 18:52:03 +02:00
2026-10-10 18:20:49 +02:00
2026-10-10 18:20:49 +02:00
2026-10-21 12:17:33 +02:00
2026-10-21 12:17:33 +02:00
2026-05-05 01:16:57 -07:00
2026-09-03 18:52:03 +02:00
2026-10-26 15:42:42 +01:00
2026-10-25 12:11:09 +01:00
2026-09-17 21:58:34 +02:00
2026-04-16 00:09:36 -07:00
2026-09-20 15:12:36 +02:00
2026-10-17 11:46:23 +02:00
2026-10-17 11:46:18 +02:00
2026-06-04 16:27:48 -07:00
2026-05-05 01:58:52 -07:00
2026-05-19 23:53:41 -07:00
2026-03-31 01:10:56 -07:00
2026-09-05 09:57:44 +02:00
2026-10-26 21:09:01 +01:00
2026-10-26 21:09:01 +01:00
2026-10-26 15:42:29 +01:00
2026-10-26 15:42:29 +01:00
2026-10-26 15:42:29 +01:00
2026-09-04 15:15:16 +02:00
2026-09-04 15:15:16 +02:00
2026-10-26 15:42:15 +01:00
2026-10-26 15:42:15 +01:00
2026-09-03 18:52:03 +02:00
2026-10-26 15:42:15 +01:00
2026-04-03 13:11:59 -07:00
2026-06-19 11:37:16 -07:00
2026-09-16 09:02:13 +02:00
2026-06-11 10:10:12 -07:00
2026-06-11 10:10:12 -07:00
2026-10-12 12:42:17 +02:00
2026-05-15 16:21:14 +00:00
2026-05-16 19:55:00 +00:00
2026-09-03 18:52:03 +02:00
2026-05-15 20:24:55 -07:00
2026-05-15 22:46:25 -07:00
2026-09-16 09:02:13 +02:00
2026-09-06 21:00:44 +02:00
2026-10-12 12:41:46 +02:00
2026-10-13 08:37:54 +02:00
2026-09-16 09:02:13 +02:00
2026-05-21 14:00:15 -07:00
2026-10-09 19:58:42 +02:00
2026-05-02 20:35:15 -07:00
2026-05-17 16:13:11 +00:00
2026-05-19 08:08:28 -07:00
2026-05-18 23:19:27 -07:00
2026-09-16 09:02:13 +02:00
2026-06-25 05:05:46 -07:00
2026-09-16 09:02:13 +02:00
2026-06-11 07:38:36 -07:00
2026-09-03 18:52:03 +02:00
2026-06-11 07:38:36 -07:00
2026-06-06 22:44:59 -07:00
2026-09-16 09:02:13 +02:00
2026-09-16 09:02:13 +02:00
2026-10-12 11:13:53 +02:00
2026-09-16 09:02:13 +02:00
2026-09-16 09:02:13 +02:00
2026-10-11 11:28:20 +02:00
2026-10-11 11:28:20 +02:00
2026-10-26 21:08:40 +01:00
2026-09-03 18:52:03 +02:00
2026-09-16 09:02:13 +02:00
2026-09-16 09:02:13 +02:00
2026-09-02 10:27:48 +02:00
2026-06-30 15:16:31 -07:00
2026-06-12 08:11:02 -07:00
2026-09-02 10:27:48 +02:00
2026-10-08 15:58:07 +02:00
2026-09-16 09:02:13 +02:00
2026-05-03 08:56:09 -07:00
2026-05-21 14:00:15 -07:00
2026-09-16 09:02:13 +02:00
2026-10-21 12:17:37 +02:00
2026-04-02 23:45:03 -07:00
2026-09-03 18:52:03 +02:00
2026-09-03 18:52:03 +02:00
2026-05-29 02:42:21 -07:00
2026-05-29 02:42:21 -07:00
2026-05-29 02:42:21 -07:00
2026-10-21 12:17:37 +02:00
2026-05-16 10:14:44 -07:00
2026-10-21 12:17:37 +02:00
2026-10-21 12:17:33 +02:00
2026-10-21 12:17:37 +02:00
2026-09-16 09:02:13 +02:00
2026-10-17 11:46:23 +02:00
2026-09-16 09:02:13 +02:00
2026-05-19 23:53:41 -07:00
2026-10-22 21:20:42 +02:00
2026-10-10 11:03:56 +02:00
2026-10-10 11:03:56 +02:00
2026-09-03 18:52:03 +02:00
2026-09-13 21:09:51 +02:00
2026-09-22 07:55:37 +02:00
2026-09-22 07:55:37 +02:00
2026-10-16 10:53:10 +02:00
2026-10-15 16:31:00 +02:00
2026-09-13 19:59:56 +02:00
2026-10-16 09:27:21 +02:00
2026-09-16 09:02:13 +02:00
2026-06-09 03:23:48 -07:00
2026-10-25 12:10:58 +01:00
2026-10-29 22:50:59 +01:00
2026-10-29 22:50:59 +01:00
2026-10-29 22:50:59 +01:00
2026-09-16 09:02:13 +02:00
2026-10-19 00:36:51 +02:00
2026-10-19 00:36:51 +02:00
2026-10-09 21:20:34 +02:00
2026-10-29 22:50:59 +01:00
2026-10-29 22:50:59 +01:00
2026-06-19 11:37:16 -07:00
2026-10-21 15:17:58 +02:00
2026-10-17 11:46:18 +02:00
2026-09-23 09:45:18 +02:00
2026-05-18 09:22:27 -07:00
2026-09-03 18:52:03 +02:00
2026-10-10 21:21:50 +02:00
2026-10-26 09:50:20 +01:00
2026-10-26 09:50:20 +01:00
2026-10-10 20:54:35 +02:00
2026-10-10 20:54:35 +02:00
2026-10-26 09:50:20 +01:00
2026-10-26 09:50:20 +01:00
2026-10-22 21:20:42 +02:00
2026-10-26 09:50:20 +01:00
2026-10-22 19:11:30 +02:00
2026-10-22 21:20:42 +02:00
2026-10-26 15:42:01 +01:00
2026-10-26 15:42:01 +01:00
2026-10-13 09:01:57 +02:00
2026-09-22 11:08:17 +02:00
2026-10-28 19:10:41 +01:00
2026-10-26 09:50:20 +01:00
2026-10-28 19:10:41 +01:00
2026-10-28 19:10:41 +01:00
2026-10-14 21:07:20 +02:00
2026-10-14 21:07:20 +02:00
2026-09-03 18:52:03 +02:00
2026-10-20 10:41:01 +02:00
2026-09-03 18:52:03 +02:00
2026-09-02 09:50:26 +02:00
2026-10-28 19:10:41 +01:00
2026-10-28 19:10:41 +01:00
2026-10-28 19:10:41 +01:00
2026-10-28 19:10:41 +01:00
2026-10-29 06:25:42 +01:00
2026-10-29 06:25:42 +01:00
2026-05-29 01:08:12 -07:00
2026-05-29 01:08:12 -07:00
2026-10-31 12:01:19 +01:00
2026-10-29 22:36:53 +01:00
2026-10-13 08:37:54 +02:00
2026-05-29 02:42:21 -07:00
2026-05-29 02:42:21 -07:00
2026-09-03 18:52:03 +02:00
2026-09-03 18:52:03 +02:00
2026-10-26 15:41:05 +01:00
2026-10-31 11:59:20 +01:00
2026-10-31 11:59:20 +01:00
2026-10-29 18:33:41 +01:00
2026-07-07 00:12:44 -07:00
2026-10-29 18:34:06 +01:00
2026-09-03 18:52:03 +02:00
2026-10-31 11:59:20 +01:00
2026-10-20 10:41:01 +02:00
2026-10-29 18:34:06 +01:00
2026-05-17 16:13:11 +00:00
2026-05-25 22:32:00 -07:00
2026-06-04 23:48:47 -07:00
2026-10-05 20:32:40 +02:00
2026-05-15 22:46:28 -07:00
2026-05-15 22:46:28 -07:00
2026-05-15 22:46:28 -07:00
2026-05-15 22:46:28 -07:00
2026-05-15 22:46:28 -07:00
2026-09-02 09:50:09 +02:00
2026-09-03 18:52:03 +02:00
2026-10-12 12:45:41 +02:00
2026-10-26 15:42:01 +01:00
2026-10-08 14:34:31 +02:00
2026-10-26 15:42:01 +01:00
2026-09-02 14:34:20 +02:00
2026-10-26 15:42:01 +01:00
2026-10-09 19:58:42 +02:00
2026-10-21 11:58:28 +02:00
2026-09-30 11:39:25 +02:00
2026-10-09 19:58:42 +02:00
2026-09-30 11:39:25 +02:00
2026-09-30 11:39:25 +02:00
2026-09-30 11:39:25 +02:00
2026-09-03 18:52:03 +02:00
2026-09-03 18:52:03 +02:00
2026-05-08 16:29:23 -07:00
2026-05-08 16:29:23 -07:00
2026-06-07 09:28:51 -07:00
2026-05-05 17:56:56 -07:00
2026-09-16 09:02:13 +02:00
2026-04-01 19:26:11 -07:00
2026-06-06 22:45:05 -07:00
2026-05-15 09:16:39 -07:00
2026-09-16 09:02:13 +02:00
2026-10-10 18:20:49 +02:00
2026-10-08 21:51:42 +02:00
2026-10-08 21:51:42 +02:00
2026-10-26 21:08:40 +01:00
2026-10-26 21:08:40 +01:00
2026-10-07 09:25:29 +02:00
2026-06-27 22:03:05 -07:00
2026-06-27 22:03:05 -07:00
2026-05-03 19:50:01 -07:00
2026-10-10 21:21:50 +02:00
2026-10-15 16:31:00 +02:00
2026-10-10 21:23:05 +02:00
2026-10-03 12:16:55 +02:00
2026-10-17 11:46:18 +02:00
2026-10-03 12:16:55 +02:00
2026-10-13 15:42:18 +02:00
2026-05-21 11:39:43 -07:00
2026-05-20 20:57:02 -07:00
2026-09-03 18:52:03 +02:00
2026-05-28 15:01:58 -07:00
2026-10-08 14:34:31 +02:00
2026-06-06 20:46:42 -07:00
2026-06-06 20:46:42 -07:00
2026-07-08 15:13:39 -07:00
2026-09-02 18:34:59 +02:00
2026-10-12 12:41:46 +02:00
2026-05-20 20:57:02 -07:00
2026-10-08 14:34:31 +02:00
2026-10-21 15:17:58 +02:00
2026-10-21 15:17:58 +02:00
2026-10-07 09:25:29 +02:00
2026-05-15 16:21:14 +00:00
2026-05-15 09:16:39 -07:00
2026-09-03 18:52:03 +02:00
2026-09-03 18:52:03 +02:00
2026-10-17 11:46:18 +02:00
2026-10-21 11:58:28 +02:00
2026-10-09 19:58:42 +02:00
2026-10-17 11:46:23 +02:00
2026-10-17 11:46:23 +02:00
2026-10-13 09:01:57 +02:00
2026-09-13 20:37:14 +02:00
2026-10-29 22:39:02 +01:00
2026-10-04 22:11:34 +02:00
2026-10-29 22:39:02 +01:00
2026-10-25 12:10:47 +01:00
2026-10-21 15:18:14 +02:00
2026-10-21 15:18:14 +02:00
2026-10-21 15:18:14 +02:00
2026-10-25 12:10:47 +01:00
2026-10-25 12:10:47 +01:00
2026-05-18 07:36:28 -07:00
2026-05-03 17:56:12 -07:00
2026-09-03 18:52:03 +02:00
2026-10-22 19:11:30 +02:00
2026-10-31 12:01:19 +01:00
2026-10-15 10:30:08 +02:00
2026-10-25 12:11:09 +01:00
2026-06-19 11:37:16 -07:00
2026-10-10 17:39:33 +02:00
2026-10-10 17:39:33 +02:00
2026-10-10 18:20:49 +02:00
2026-10-04 17:15:50 +02:00
2026-10-10 17:39:33 +02:00
2026-10-10 18:20:49 +02:00
2026-10-29 22:39:02 +01:00
2026-05-15 16:21:14 +00:00
2026-10-11 11:17:12 +02:00
2026-09-19 11:44:47 +02:00
2026-10-11 11:17:12 +02:00
2026-09-11 15:07:31 +02:00
2026-09-11 15:07:31 +02:00
2026-09-19 11:44:47 +02:00
2026-10-10 21:22:02 +02:00
2026-10-11 11:17:12 +02:00
2026-09-09 17:58:09 +02:00
2026-09-10 22:30:24 +02:00
2026-10-07 11:20:44 +02:00
2026-10-07 11:20:44 +02:00
2026-10-07 11:20:44 +02:00
2026-10-07 11:20:44 +02:00
2026-05-03 17:40:54 -07:00
2026-11-08 17:46:17 +01:00
2026-06-03 13:58:04 -07:00
2026-06-30 18:21:21 -07:00
2026-04-20 23:10:33 -07:00
2026-10-20 11:04:07 +02:00
2026-10-09 19:58:42 +02:00
2026-10-20 11:04:07 +02:00
2026-10-26 15:42:01 +01:00
2026-10-20 10:41:01 +02:00
2026-04-21 09:09:39 -07:00
2026-10-29 18:34:06 +01:00
2026-05-29 02:42:21 -07:00
2026-10-12 12:41:46 +02:00
2026-10-13 08:35:16 +02:00
2026-10-12 12:41:46 +02:00
2026-10-10 21:21:13 +02:00
2026-05-03 17:41:22 -07:00
2026-05-03 17:41:22 -07:00
2026-09-16 09:02:13 +02:00
2026-10-12 12:41:46 +02:00
2026-06-27 22:03:05 -07:00
2026-09-02 18:34:59 +02:00
2026-10-13 08:35:20 +02:00
2026-10-13 08:35:20 +02:00
2026-10-29 22:36:53 +01:00
2026-06-27 22:03:05 -07:00
2026-06-27 22:03:05 -07:00
2026-06-27 22:03:05 -07:00
2026-06-27 22:03:05 -07:00
2026-10-28 19:10:41 +01:00
2026-10-28 19:10:41 +01:00
2026-10-10 18:20:49 +02:00
2026-10-08 22:16:49 +02:00
2026-10-08 22:16:49 +02:00
2026-06-29 05:48:58 -07:00
2026-09-13 19:59:18 +02:00
2026-11-08 17:46:17 +01:00
2026-09-06 21:11:29 +02:00
2026-09-06 21:11:29 +02:00
2026-09-02 14:21:42 +02:00