feat(renderJson): default ?renderJson CORS to open (any origin, no credentials) - #476
Merged
Merged
Conversation
…edentials) ?renderJson is public page data — secrets and request-derived keys are stripped before serialization — so it should be readable cross-origin out of the box, the same as any public API. pageJsonCors now defaults to "*" (Access-Control-Allow- Origin: * without credentials) instead of off. `false` turns it off; a string[] still reflects an allow-listed Origin *with* credentials for personalized cases. Type: string[] | "*" | false. No credentials with "*" (per the CORS spec), so no logged-in/personalized leak — the earlier off-by-default was over-cautious for public content. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
JonasJesus42
added a commit
to deco-sites/docs
that referenced
this pull request
Aug 18, 2026
Reflects decocms/blocks#476 — pageJsonCors now defaults to "*" (any origin, no credentials) since ?renderJson is public page data. A list restricts to credentialed origins; false disables. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
🎉 This PR is included in version 7.44.0 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
?renderJsonis public page data — secrets and request-derived keys are stripped before serialization — so it should be readable cross-origin out of the box, like any public API.pageJsonCorsnow defaults to"*"(Access-Control-Allow-Origin: *without credentials) instead of off.falseturns it off; astring[]still reflects an allow-listed Origin with credentials for personalized cases. Since"*"carries no credentials (per the CORS spec) there's no logged-in/personalized leak — the earlier off-by-default was over-cautious for public content. tanstack tsc clean.🤖 Generated with Claude Code
Summary by cubic
Default-open CORS for
?renderJson: whenpageJsonCorsis unset, we now sendAccess-Control-Allow-Origin: *(no credentials), since the payload is public (secrets and request-derived keys are stripped). Previously the default sent no CORS headers;falsenow explicitly disables CORS; astring[]still allow-lists origins with credentials for personalized cases."*"; to restore the old default, setpageJsonCors: false.pageJsonCorsto astring[].packages/tanstack/src/sdk/workerEntry.tsfor both GET and OPTIONS paths. Verify headers match your security requirements.Written for commit ba6b003. Summary will update on new commits.