mirror of
https://github.com/nexu-io/open-design.git
synced 2026-10-27 09:51:12 +01:00
74344a370f
* fix(daemon): add CORS header to raw project file endpoint srcdoc iframes have a null origin. When preview HTML fetches component files from /api/projects/:id/raw/*, the browser blocks the response because the route returned no Access-Control-Allow-Origin header. Only respond with the header when the request Origin is the string "null" — the signature of a srcdoc iframe. Real cross-origin requests from other websites remain blocked, keeping the endpoint safe even if the daemon is deployed on a remote server. Fixes #134 * fix(daemon): add CORS header to raw project file endpoint srcdoc iframes have a null origin. When preview HTML fetches component files from /api/projects/:id/raw/*, the browser blocks the response because the route returned no Access-Control-Allow-Origin header. Only respond with the header when the request Origin is the string "null" — the signature of a srcdoc iframe. Real cross-origin requests from other websites remain blocked, keeping the endpoint safe even if the daemon is deployed on a remote server. Also add an OPTIONS preflight handler to future-proof the route for artifacts that may send custom request headers, and add test coverage for the null-origin allow / real-origin block behaviour. Fixes #134 --------- Co-authored-by: jiangding001 <jiangding001@ke.com>