mirror of
https://github.com/hanzo-apps/world.git
synced 2026-10-30 14:53:09 +00:00
hanzo-dev
73c0f7cbcb
The allowlist named only worldmonitor.app and a personal Vercel preview
namespace, elie-habib-projects.vercel.app. Two consequences: a browser calling
this API from world.hanzo.ai was refused, and any preview deployment under that
third-party namespace was trusted by our API. The fallback origin was upstream's
domain too, so a rejected request was handed a header naming someone else's site.
Allowlist is hanzo.ai and its subdomains plus the local and Tauri origins the
desktop build needs; the fallback is world.hanzo.ai.
README: the fork blurb and the badges advertising upstream's hosted variants and
downloads are gone — attribution belongs in NOTICE, which names the upstream
project, the fork point (v2.4.0, 572f3808) and the original author.
35 lines
1.2 KiB
JavaScript
35 lines
1.2 KiB
JavaScript
// Our own surfaces. This fork serves world.hanzo.ai; the upstream domains were
|
|
// the only ones listed here, so a browser calling this API from our own site was
|
|
// refused and handed upstream's origin as the fallback.
|
|
const ALLOWED_ORIGIN_PATTERNS = [
|
|
/^https:\/\/(.*\.)?hanzo\.ai$/,
|
|
/^https?:\/\/localhost(:\d+)?$/,
|
|
/^https?:\/\/127\.0\.0\.1(:\d+)?$/,
|
|
/^https?:\/\/tauri\.localhost(:\d+)?$/,
|
|
/^https?:\/\/[a-z0-9-]+\.tauri\.localhost(:\d+)?$/i,
|
|
/^tauri:\/\/localhost$/,
|
|
/^asset:\/\/localhost$/,
|
|
];
|
|
|
|
function isAllowedOrigin(origin) {
|
|
return Boolean(origin) && ALLOWED_ORIGIN_PATTERNS.some((pattern) => pattern.test(origin));
|
|
}
|
|
|
|
export function getCorsHeaders(req, methods = 'GET, OPTIONS') {
|
|
const origin = req.headers.get('origin') || '';
|
|
const allowOrigin = isAllowedOrigin(origin) ? origin : 'https://world.hanzo.ai';
|
|
return {
|
|
'Access-Control-Allow-Origin': allowOrigin,
|
|
'Access-Control-Allow-Methods': methods,
|
|
'Access-Control-Allow-Headers': 'Content-Type',
|
|
'Access-Control-Max-Age': '86400',
|
|
'Vary': 'Origin',
|
|
};
|
|
}
|
|
|
|
export function isDisallowedOrigin(req) {
|
|
const origin = req.headers.get('origin');
|
|
if (!origin) return false;
|
|
return !isAllowedOrigin(origin);
|
|
}
|