- Chrome now enforces that servers on private networks explicitly
grant access to public websites using a new header
"Access-Control-Allow-Private-Network" that should be sent in
responses to preflight OPTIONS requests.
- This change implements special handling for OPTIONS requests by
sending all the existing CORS headers along with the new
Access-Control-Allow-Private-Network header if private network
access is being requested.
- See https://developer.chrome.com/blog/private-network-access-preflight/
for more info.
* Improve and simplify code handling CORS
* Don't execute request when origin not allowed
Fix vulnerability
* Remove webCorsOrigin legacy option
It's confusing (and potentially insecure as removing webCorsOrigin in configuration would still set it to localhost)
* Allow 127.0.0.1 and browser extension if localhost allowed
* Server no longer hangs on client disconnects
* Changed timeout and am now catching errors explicitly
Co-authored-by: KanjiEater <kanjieat3r@gmail.com>
