Repository navigation

fix(security): remove localhost CORS origin, consolidate CORS in proxy - #4658

Merged

waleedlatif1 merged 6 commits into

waleedlatif1/csp-localhost-review

May 19, 2026

Merged

fix(security): remove localhost CORS origin, consolidate CORS in proxy#4658
waleedlatif1 merged 6 commits into
stagingfrom
waleedlatif1/csp-localhost-review

Commits on May 19, 2026
- fix(security): remove localhost CORS origin, consolidate CORS in proxy
  waleedlatif1
  committed
  e168fab
- refactor(cors): consolidate API CORS into proxy as single source of truth
  
  waleedlatif1
  and
  claude
  committed
  ae03108
- refactor(cors): convert proxy CORS policy chain to a rule table + add tests
  
  waleedlatif1
  and
  claude
  committed
  b2956f1
- fix(cors): scope embed CORS rule to /api/{chat,form}/[identifier] only
  
  waleedlatif1
  and
  claude
  committed
  99bb0f9
- refactor(cors): replace embed-path regex with explicit segment check
  
  waleedlatif1
  and
  claude
  committed
  80aa102
- fix(cors): allow PUT in embed CORS policy for OTP verification
  
  waleedlatif1
  and
  claude
  committed
  5968f3b