WaleedandClaude Opus 4.7 d9dd7a3e55 fix(cors): re-enable credentials on chat/form embed CORS policy (#4673) ...

* fix(cors): re-enable credentials on embed CORS policy

Chat and form embeds authenticate via the chat_auth_<id> / form auth
cookie set by setDeploymentAuthCookie. The previous PR set
Access-Control-Allow-Credentials: false on these routes, which made the
browser drop the auth cookie and produce 401s on subsequent embed calls
after login. Restore credentials: true (matching pre-consolidation
behavior) while keeping reflected origin and Vary: Origin.

The wildcard fallback when Origin is absent now also drops credentials
to stay CORS-spec-compliant.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* chore(cors): trim verbose comments in proxy

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* chore(cors): restore concise TSDoc on proxy CORS helpers

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

2026-05-20 10:55:26 -07:00

..

docs

improvement(media-blocks): new versions of image and video gen with latest models + fixes (#4667)

2026-05-19 16:42:04 -07:00

realtime

chore(utils): migrate to shared random/ID utilities and add enforcement linting (#4623)

2026-05-15 17:31:27 -07:00

sim

fix(cors): re-enable credentials on chat/form embed CORS policy (#4673)

2026-05-20 10:55:26 -07:00