fix: harden CORS by rejecting missing Origin header#904

Closed

Pcmhacker-piro wants to merge 2 commits into

utksh1:mainfrom

Pcmhacker-piro:fix/harden-cors-origin-header

Commits on Jun 14, 2026

fix: harden CORS by rejecting missing Origin header
OpenCode Agent
committed
fix: only reject disallowed CORS origins, allow missing Origin and known origins
OpenCode Agent
committed