lightgun-poc / lib/cors / corsHeaders

Function: corsHeaders()

corsHeaders(r, allowed, preflight): Record<string, string> | null

Defined in: lib/cors.ts:55

Headers to attach: {} when no Origin is present (nothing needed) or the request is same-origin (the browser only enforces CORS cross-origin), the CORS set when the Origin is on the allowlist, null when it is neither — the caller turns null into a 403 on anything state-changing.

The Access-Control-Allow-Origin value is taken out of OUR allowlist, never echoed from the request header — reflecting a request's Origin, even a validated one, is the classic CORS-injection shape.

Access-Control-Allow-Private-Network answers the Private-Network-Access preflight of pre-LNA Chromes (130–141); Chrome 142+ relies on the LNA permission prompt instead and ignores it. Harmless, widens compatibility.

Parameters

r

OriginInfo

allowed

string[]

preflight

boolean

Returns

Record<string, string> | null