fix(security): remove localhost CORS origin, consolidate CORS in proxy#4658

Merged

waleedlatif1 merged 6 commits into

waleedlatif1/csp-localhost-review

May 19, 2026

Commits on May 19, 2026

fix(security): remove localhost CORS origin, consolidate CORS in proxy
waleedlatif1
committed
refactor(cors): consolidate API CORS into proxy as single source of truth

waleedlatif1
and
claude
committed
refactor(cors): convert proxy CORS policy chain to a rule table + add tests

waleedlatif1
and
claude
committed
fix(cors): scope embed CORS rule to /api/{chat,form}/[identifier] only

waleedlatif1
and
claude
committed
refactor(cors): replace embed-path regex with explicit segment check

waleedlatif1
and
claude
committed
fix(cors): allow PUT in embed CORS policy for OTP verification

waleedlatif1
and
claude
committed