feat: add per-route CORS origin allowlist for HTTP triggers - #10833

Open

hugocasa wants to merge 13 commits into

mainfrom

http-trigger-cors-config

Commits on Aug 25, 2026

feat: add per-route CORS origin allowlist for HTTP triggers

hugocasa
and
claude
committed
27474f9
fix: fail closed on cold router cache and invalid origin input

hugocasa
and
claude
committed
5eb4059
fix: resolve CORS route from the decoded path like the request handler

hugocasa
and
claude
committed
ff38e7d
feat: add instance-wide default allowed origins for HTTP routes

hugocasa
and
claude
committed
165db54
fix: let non-superadmins read the default allowed origins setting

hugocasa
and
claude
committed
35fb9c5
feat: badge the advanced section when a route's origins are restricted

hugocasa
and
claude
committed
8df2b2c

Commits on Aug 26, 2026

fix: state inherited origins on the control and use one hint row

hugocasa
and
claude
committed
9b715fc
fix: trim the origins tooltip and relabel the toggle when a default exists

hugocasa
and
claude
committed
a8145df
fix: keep the origins format hint visible until an entry is wrong

hugocasa
and
claude
committed
071ee1a
fix: state the at-least-one requirement in the origins hint

hugocasa
and
claude
committed
c83c1e1
fix: import the origins validator in the trigger-http tests

hugocasa
and
claude
committed
ba544a7
fix: make an empty allowlist deny rather than fall back to the default

hugocasa
and
claude
committed
25c8fda
fix: address review nits on origin validation and the CORS editor
hugocasa
committed
8a9a028