[PR #260] [CLOSED] Configure CORS origins for worker #257

New issue

Closed

opened 2026-02-27 09:13:58 +03:00 by kerem · 0 comments

kerem commented

2026-02-27 09:13:58 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/maillab/cloud-mail/pull/260
Author: @zlylong
Created: 2/9/2026
Status: ❌ Closed

Base: main ← Head: main

📝 Commits (2)

0d2b539 Configure CORS origins for worker
4ce9ec1 Merge pull request #1 from zlylong/codex/configure-cors-with-origin-whitelist

📊 Changes

2 files changed (+58 additions, -2 deletions)

View changed files

📝 mail-worker/src/hono/hono.js (+57 -2)
📝 mail-worker/wrangler.toml (+1 -0)

📄 Description

#cors_origins = [] #CORS允许的前端域名列表示例: ["https://mail.example.com"]
mail-worker/src/hono/hono.js 使用 app.use('*', cors())，默认允许所有来源，可能导致跨站请求风险（尤其是前端会带认证信息时）。建议限制到明确允许的域名列表并配置 credentials 等参数。

收敛 CORS 允许的来源并显式配置

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/maillab/cloud-mail/pull/260 **Author:** [@zlylong](https://github.com/zlylong) **Created:** 2/9/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (2) - [`0d2b539`](https://github.com/maillab/cloud-mail/commit/0d2b539c234f66ec4c35a2c1fe34d3aceaa0ded4) Configure CORS origins for worker - [`4ce9ec1`](https://github.com/maillab/cloud-mail/commit/4ce9ec1f4e230a8fae51558e52b6591021a70b09) Merge pull request #1 from zlylong/codex/configure-cors-with-origin-whitelist ### 📊 Changes **2 files changed** (+58 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `mail-worker/src/hono/hono.js` (+57 -2) 📝 `mail-worker/wrangler.toml` (+1 -0) </details> ### 📄 Description #cors_origins = [] #CORS允许的前端域名列表示例: ["https://mail.example.com"] mail-worker/src/hono/hono.js 使用 app.use('*', cors())，默认允许所有来源，可能导致跨站请求风险（尤其是前端会带认证信息时）。建议限制到明确允许的域名列表并配置 credentials 等参数。收敛 CORS 允许的来源并显式配置 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>