Only send Access-Control-Allow-Origin: in response to a CORS request.

This saves a bit of bandwidth. NFC otherwise.
This commit is contained in:
Catherine
2025-09-21 08:19:08 +00:00
parent 2af2975713
commit 21227ce59f

View File

@@ -53,8 +53,10 @@ func getPage(w http.ResponseWriter, r *http.Request) error {
}
}
// allow JavaScript code to access responses (including errors) even across origins
w.Header().Set("Access-Control-Allow-Origin", "*")
if r.Header.Get("Origin") != "" {
// allow JavaScript code to access responses (including errors) even across origins
w.Header().Set("Access-Control-Allow-Origin", "*")
}
if sitePath == ".git-pages" {
// metadata directory name shouldn't be served even if present in site manifest