Skip to content

Relax CORS policy for template servers - #26

Merged
MiguelsPizza merged 2 commits into
mainfrom
claude/relax-cors-policy-019gEisVuMFm5ESkD8T9z3WD
Nov 23, 2025
Merged

Relax CORS policy for template servers#26
MiguelsPizza merged 2 commits into
mainfrom
claude/relax-cors-policy-019gEisVuMFm5ESkD8T9z3WD

Conversation

@MiguelsPizza

Copy link
Copy Markdown
Contributor

Update both React and Vanilla template servers to use the most permissive CORS policy possible to enable embedding anywhere:

  • Allow all origins (origin: '*')
  • Allow all headers (allowHeaders: ['*'])
  • Allow all HTTP methods (allowMethods: ['*'])
  • Expose all headers to clients (exposeHeaders: ['*'])
  • Enable credentials support (credentials: true)
  • Cache preflight requests for 24 hours (maxAge: 86400)

This ensures maximum compatibility when embedding these servers in iframes, third-party sites, or any other context.

Description

Type of Change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update
  • Refactoring (no functional changes)
  • Performance improvement
  • Test addition/improvement

Related Issues

Fixes #
Related to #

Changes Made

  • Change 1
  • Change 2
  • Change 3

Testing

Test Commands Run

pnpm typecheck  # ✓ Passed
pnpm lint       # ✓ Passed
pnpm build      # ✓ Passed
pnpm test       # ✓ Passed - E2E tests run locally

Manual Testing

  • Tested in development mode (pnpm dev)
  • Tested production build (pnpm build && preview)
  • Tested on mobile/tablet (if UI changes)
  • Tested WebMCP integration (if applicable)
  • Tested MCP tool execution (if applicable)

Screenshots

Checklist

  • My code follows the style guidelines in CONTRIBUTING.md
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings or errors
  • I have added tests that prove my fix is effective or that my feature works
  • I have run E2E tests locally (pnpm test) and they pass
  • New and existing unit tests pass locally with my changes
  • Any dependent changes have been merged and published

Breaking Changes

None

Additional Notes

Update both React and Vanilla template servers to use the most permissive
CORS policy possible to enable embedding anywhere:

- Allow all origins (origin: '*')
- Allow all headers (allowHeaders: ['*'])
- Allow all HTTP methods (allowMethods: ['*'])
- Expose all headers to clients (exposeHeaders: ['*'])
- Enable credentials support (credentials: true)
- Cache preflight requests for 24 hours (maxAge: 86400)

This ensures maximum compatibility when embedding these servers in
iframes, third-party sites, or any other context.
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Nov 23, 2025

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
✅ Deployment successful!
View logs
mcp-ui-with-webmcp-my-mcp-server 62afabe Nov 23 2025, 12:28 AM

@MiguelsPizza
MiguelsPizza merged commit ca7d331 into main Nov 23, 2025
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants