WorkRoot/WRNexusJS
2
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(core): preserve explicit public resource embedding policies
Quality / quality (ubuntu-latest) (push) Canceled after 0s
Details
Quality / quality (windows-latest) (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
Clintchiz committed 2026-10-01 22:33:24 +05:30
1 parent ed1d3a59cf
commit ff1065fb27
6 files changed
+22 -7
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

packages/core/src/headers.ts
+6 -1
View File
@@ -258,7 +258,12 @@ function applyBaseSecurityHeaders(
if (referrerPolicy !== false) headers.set("Referrer-Policy", referrerPolicy);
const corp = security?.crossOriginResourcePolicy ?? "same-origin";
if (corp !== false) headers.set("Cross-Origin-Resource-Policy", corp);
// A handler can deliberately expose a public image for email embedding.
// An explicitly configured application policy still takes precedence.
const responseCorp = headers.get("Cross-Origin-Resource-Policy");
if (corp !== false && (security?.crossOriginResourcePolicy !== undefined || !["same-origin", "same-site", "cross-origin"].includes(responseCorp ?? ""))) {
headers.set("Cross-Origin-Resource-Policy", corp);
}
if (security?.originAgentCluster !== false) headers.set("Origin-Agent-Cluster", "?1");
if (security?.disableDnsPrefetch !== false) headers.set("X-DNS-Prefetch-Control", "off");