feat(server)!: default CORS origin to "*" and support async origin options - #1914
Merged
dinwwwh merged 4 commits intoAug 22, 2026
Merged
Conversation
…tions CORSHandlerPlugin now defaults origin to "*" instead of reflecting the request origin, and the origin/timingOrigin options accept async functions so the allowed origin can be resolved per request from the handler context.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
More templates
@orpc/ai-sdk
@orpc/arktype
@orpc/bun
@orpc/client
@orpc/cloudflare
@orpc/contract
@orpc/experimental-effect
@orpc/evlog
@orpc/hibernation
@orpc/json-schema
@orpc/experimental-msw
@orpc/nest
@orpc/next
@orpc/node
@orpc/openapi
@orpc/opentelemetry
@orpc/pinia-colada
@orpc/pino
@orpc/publisher
@orpc/ratelimit
@orpc/server
@orpc/shared
@orpc/swr
@orpc/tanstack-query
@orpc/trpc
@orpc/valibot
@orpc/zod
commit: |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
ℹ️ Minor suggestion — the change is well-scoped, documented, and tested. One footgun worth a thought before merge.
Reviewed changes
- Defaulted
originto'*'in the CORS handler plugin, so responses carryAccess-Control-Allow-Origin: *with noVary: Originunlessoriginis configured to reflect/match. (cors.ts) - Widened
origin/timingOriginoption types toValue<Promisable<...>, [...]>and awaited the resolution (toArray(await value(...))), enabling async per-request resolution from the interceptor options (includingcontext). (cors.ts) - Updated default-behavior expectations and added async
originandtimingOrigintests with exact assertions. (cors.test.ts) - Documented the breaking default and the v1 restore pattern in
from-v1.mdx, and added a Dynamic Origin example plus a credentialed-wildcard warning incors.mdx.
DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏
| constructor(options: CORSHandlerPluginOptions<T> = {}) { | ||
| const defaults: CORSHandlerPluginOptions<T> = { | ||
| origin: origin => origin, | ||
| origin: '*', |
Contributor
There was a problem hiding this comment.
With origin now defaulting to '*', any existing credentials: true setup that doesn't explicitly set origin will emit both Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true on every response, which browsers reject. The docs warn, but a runtime guard would turn a silent misconfiguration into an early error. Consider throwing when credentials is combined with a wildcard origin (whether explicit or via the new default), or otherwise short-circuiting the invalid pair.
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CORSHandlerPlugin now defaults
originto*instead of reflecting the request origin, and theoriginandtimingOriginoptions accept async functions so the allowed origin can be resolved per request from the handler context.Breaking
Access-Control-Allow-Origin: *with noVary: Originheader; setups relying oncredentialsmust configureoriginexplicitly (e.g.origin: origin => originrestores the v1 behavior). Documented in the v1 migration guide.Docs
*default is rejected by browsers for credentialed requests, and adds a Dynamic Origin section with an asyncoriginresolved from context.Testing
origin/timingOrigincovered by new tests; full server suite (505 tests), type check, lint, and docs validation pass.