Skip to content

feat: add per-route CORS origin allowlist for HTTP triggers #10833

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
hugocasa wants to merge 26 commits into
base: main
Choose a base branch
from
Draft

feat: add per-route CORS origin allowlist for HTTP triggers #10833

Show file tree
Hide file tree
Changes from 12 commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
27474f9
feat: add per-route CORS origin allowlist for HTTP triggers
hugocasa Aug 25, 2026
5eb4059
fix: fail closed on cold router cache and invalid origin input
hugocasa Aug 25, 2026
ff38e7d
fix: resolve CORS route from the decoded path like the request handler
hugocasa Aug 25, 2026
165db54
feat: add instance-wide default allowed origins for HTTP routes
hugocasa Aug 25, 2026
35fb9c5
fix: let non-superadmins read the default allowed origins setting
hugocasa Aug 25, 2026
8df2b2c
feat: badge the advanced section when a route's origins are restricted
hugocasa Aug 25, 2026
9b715fc
fix: state inherited origins on the control and use one hint row
hugocasa Aug 26, 2026
a8145df
fix: trim the origins tooltip and relabel the toggle when a default e…
hugocasa Aug 26, 2026
071ee1a
fix: keep the origins format hint visible until an entry is wrong
hugocasa Aug 26, 2026
c83c1e1
fix: state the at-least-one requirement in the origins hint
hugocasa Aug 26, 2026
ba544a7
fix: import the origins validator in the trigger-http tests
hugocasa Aug 26, 2026
25c8fda
fix: make an empty allowlist deny rather than fall back to the default
hugocasa Aug 26, 2026
8a9a028
fix: address review nits on origin validation and the CORS editor
hugocasa Aug 26, 2026
027302d
fix: derive the origins error from the stored list and tighten host v…
hugocasa Aug 28, 2026
192dfc7
fix: parse real IPv6 hosts and refuse a newly emptied allowlist
hugocasa Aug 28, 2026
c854af5
Merge remote-tracking branch 'origin/main' into http-trigger-cors-config
hugocasa Aug 28, 2026
95303f6
refactor: make origin validation advisory except for null and non-ascii
hugocasa Aug 28, 2026
bfd3769
feat: let an empty allowlist be saved as deny every origin
hugocasa Aug 28, 2026
1b85a27
docs: document the empty allowlist as deny every origin
hugocasa Aug 28, 2026
4def733
fix: bound allowlists, reject commas, and decide cors after the handler
hugocasa Aug 28, 2026
322125b
chore: revert unrelated rustfmt churn in windmill-common tests
hugocasa Aug 28, 2026
c4e9815
chore: revert unrelated rustfmt churn in windmill-common
hugocasa Aug 28, 2026
473be61
chore: drop the route types the cors restructure replaced
hugocasa Aug 28, 2026
ca447a0
fix: take the stricter cors decision from before and after the handler
hugocasa Aug 28, 2026
2a7f03c
fix: strip runnable cors headers when the routers are unavailable
hugocasa Aug 28, 2026
bf7021b
docs: document the allowlist bounds in the openapi schema
hugocasa Aug 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
87 changes: 87 additions & 0 deletions backend/.sqlx/query-2ead4c5e0fec64dfdc24431d2f4871ca8667a657dfdfc2fa65e9ff1a3c0d2908.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

84 changes: 84 additions & 0 deletions backend/.sqlx/query-47e0f46fddb3ad1c854deb9bdbdcbc2bc7235c63ed4f0a885d412793f3a3a3fc.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

86 changes: 86 additions & 0 deletions backend/.sqlx/query-ab752dd133b20103800554b3f6622e8a9147d36a4b56ebd30a1aaa960156b598.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

16 changes: 16 additions & 0 deletions backend/.sqlx/query-c1976ac63f5d763b2a747ff92f5ef9db3a0579c889bcae4e8bf33467ce5cebd1.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading