fix(security): remove localhost CORS origin, consolidate CORS in proxy - #4658

Merged

waleedlatif1 merged 6 commits into

waleedlatif1/csp-localhost-review

May 19, 2026

Commits on May 19, 2026

fix(security): remove localhost CORS origin, consolidate CORS in proxy
waleedlatif1
committed
e168fab
refactor(cors): consolidate API CORS into proxy as single source of truth
waleedlatif1
and
claude
committed
ae03108
refactor(cors): convert proxy CORS policy chain to a rule table + add tests
waleedlatif1
and
claude
committed
b2956f1
fix(cors): scope embed CORS rule to /api/{chat,form}/[identifier] only
waleedlatif1
and
claude
committed
99bb0f9
refactor(cors): replace embed-path regex with explicit segment check
waleedlatif1
and
claude
committed
80aa102
fix(cors): allow PUT in embed CORS policy for OTP verification
waleedlatif1
and
claude
committed
5968f3b