Send CORS headers only from the image routes (closes #98)

Conversation 3 Commits 2 Files Changed 6

+106 -22

2 Commits

Author	SHA1	Message	Date
clawbot	97b8f22e6a	Send CORS headers only from the image routes (closes #98 ) check / check (push) Successful in 5m49s Details The CORS middleware, with the access_control_allow_origin origin, moved from the router root onto a /v1 subrouter holding /v1/image/ and /v1/e/. The login and URL generator pages, /metrics, the health check, robots.txt and /static/ no longer send Access-Control-Allow-Origin, so their safety no longer rests on the CORS options chosen for the image routes. It is a subrouter rather than a route group because a group's middleware runs only for a request that matches one of its routes, and a preflight OPTIONS request matches none. The maintenance mode group moved inside it unchanged. README.md and config.example.yml say the setting covers the image routes only. Model: opus-5-5	2026-10-03 12:41:40 +00:00
clawbot	ff69f4bce3	Test that only the image routes send CORS headers (closes #98 ) A new server test sends requests with an Origin header through the server's routes and expects Access-Control-Allow-Origin, set to the configured origin, on both image routes, a preflight OPTIONS request included, and no such header on the login and URL generator pages. It fails for now: the CORS middleware still wraps every route. The encrypted image path the maintenance tests use is now a named constant, shared with the new test; what they check is unchanged. Model: opus-5-5	2026-10-03 12:41:26 +00:00

Author

SHA1

Message

Date

clawbot

97b8f22e6a

Send CORS headers only from the image routes (closes #98 )

check / check (push) Successful in 5m49s

Details

The CORS middleware, with the access_control_allow_origin origin, moved
from the router root onto a /v1 subrouter holding /v1/image/ and /v1/e/.
The login and URL generator pages, /metrics, the health check,
robots.txt and /static/ no longer send Access-Control-Allow-Origin, so
their safety no longer rests on the CORS options chosen for the image
routes.

It is a subrouter rather than a route group because a group's
middleware runs only for a request that matches one of its routes, and
a preflight OPTIONS request matches none. The maintenance mode group
moved inside it unchanged.

README.md and config.example.yml say the setting covers the image
routes only.

Model: opus-5-5

2026-10-03 12:41:40 +00:00

clawbot

ff69f4bce3

Test that only the image routes send CORS headers (closes #98 )

A new server test sends requests with an Origin header through the
server's routes and expects Access-Control-Allow-Origin, set to the
configured origin, on both image routes, a preflight OPTIONS request
included, and no such header on the login and URL generator pages.
It fails for now: the CORS middleware still wraps every route.

The encrypted image path the maintenance tests use is now a named
constant, shared with the new test; what they check is unchanged.

Model: opus-5-5

2026-10-03 12:41:26 +00:00

Send CORS headers only from the image routes (closes #98) #162