From eba24884a083cb546250df9b4633bc14e6cad83b Mon Sep 17 00:00:00 2001 From: AAliKKhan Date: Mon, 27 Jul 2026 17:35:39 +0500 Subject: [PATCH] fix(server): treat undefined origin as non-CORS, reject empty origin string --- packages/server/src/cors.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/server/src/cors.ts b/packages/server/src/cors.ts index 92296a3b7dbf..d743796525a0 100644 --- a/packages/server/src/cors.ts +++ b/packages/server/src/cors.ts @@ -9,7 +9,7 @@ export const CorsConfig = Context.Reference("@opencode/ }) export function isAllowedCorsOrigin(input: string | undefined, opts?: CorsOptions) { - if (!input) return true + if (input === undefined) return true if (input.startsWith("http://localhost:")) return true if (input.startsWith("http://127.0.0.1:")) return true if (input.startsWith("oc://renderer")) return true @@ -20,7 +20,7 @@ export function isAllowedCorsOrigin(input: string | undefined, opts?: CorsOption } export function isAllowedRequestOrigin(input: string | undefined, host: string | undefined, opts?: CorsOptions) { - if (!input) return true + if (input === undefined) return true if (host && sameHost(input, host)) return true return isAllowedCorsOrigin(input, opts) }