corsMiddleware method

Middleware? corsMiddleware()

The CORS middleware for the Hub's allowed origins, or null when none are configured (no browser client, nothing to allow).

Install it with OmnyServerHub.useOuter, not use — it has to sit outside the error mapper to stamp a 401/404/500, which a browser can otherwise not read at all, and outside authentication to answer a preflight, which carries no credentials.

Credentials are not enabled: the dashboard authenticates with a bearer token in a header, not a cookie, so there is no reason to let the browser attach ambient credentials to a cross-origin call. That is also what makes anyOrigin tolerable — a wildcard lets any page call the API, but the browser attaches no ambient credentials, so it still needs a token it was given. It is a real widening all the same, and the Hub says so at startup.

anyOrigin is dominant: cors() only emits a literal * when no specific origin is named, so '*' cannot be combined with an allow-list — asking for both means asking for everything.

Implementation

Middleware? corsMiddleware() {
  final origins = hub.config.corsOrigins;
  if (origins.isEmpty) return null;
  if (origins.any(isAnyOrigin)) return cors(allowAnyOrigin: true);
  return cors(allowedOrigins: origins);
}