CORS

​

Overview

​

Allowed Origins

​

Adding CORS to a New Edge Function

import { getCorsHeaders, isDisallowedOrigin } from './_cors.js';

export default async function handler(req) {
  const cors = getCorsHeaders(req);

  // 1. Block disallowed origins
  if (isDisallowedOrigin(req)) {
    return new Response(JSON.stringify({ error: 'Forbidden' }), {
      status: 403,
      headers: { 'Content-Type': 'application/json', ...cors },
    });
  }

  // 2. Handle preflight
  if (req.method === 'OPTIONS') {
    return new Response(null, { status: 204, headers: cors });
  }

  // 3. Spread cors into every response
  return new Response(JSON.stringify(data), {
    headers: { 'Content-Type': 'application/json', ...cors },
  });
}

1. Every response must include ...cors in its headers — including errors, rate-limit 429s, and 500s.
2. Preflight (OPTIONS) must return 204 with CORS headers and no body.
3. getCorsHeaders(req, methods) — pass a custom methods string if the endpoint supports more than GET, OPTIONS (e.g., 'POST, OPTIONS').

​

Sebuf Gateway (RPC Endpoints)

​

Adding a New Allowed Origin

1. Update the origin policy in api/_cors.js, server/cors.ts, and workers/api-cors-preflight/src/index.js. For an app host, update APP_ORIGIN_PATTERN and the app-host inventory in convex/payments/returnUrlOrigin.ts. The Worker overrides CORS on api.worldmonitor.app; its deployment must be updated with the functions.
2. Update the behavioral parity tests in tests/cors-fail-closed.test.mts.
3. If the origin is a new production subdomain, also add it to the Cloudflare R2 CORS rules (see MEMORY.md notes on R2 CORS in the repo root).

​

Allowed Headers

• Content-Type
• Authorization
• X-WorldMonitor-Key (API key for desktop/third-party access). See API Key Gating for key management details.
• X-Api-Key
• X-Widget-Key
• X-Pro-Key
• X-WorldMonitor-Desktop-Timestamp
• X-WorldMonitor-Desktop-Signature
• Idempotency-Key
• Mcp-Session-Id
• MCP-Protocol-Version
• Last-Event-ID

​

Railway Relay CORS