fix(www): cors headers

lowlighter · Dec 19, 2024 · 8de3d7a · 8de3d7a
1 parent 57096c1
commit 8de3d7a
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/www/api/build.ts b/www/api/build.ts
@@ -13,8 +13,12 @@ export default async function (request: Request) {
   if (request.method !== "POST") {
     return new Response(StatusText[Status.MethodNotAllowed], { status: Status.MethodNotAllowed, headers })
   }
-  if (!allowed.includes(new URL(`https://${request.headers.get("Host")}`).hostname)) {
-    return new Response("Custom builds may not be linked directly", { status: Status.Forbidden, headers })
+  if ((request.headers.has("Origin")) && (allowed.includes(new URL(request.headers.get("Origin")!).hostname))) {
+    headers.set("Access-Control-Allow-Origin", "*")
+    headers.set("Access-Control-Allow-Methods", "GET, POST")
+    headers.set("Access-Control-Allow-Headers", "Content-Type")
+  } else {
+    return new Response(`Visit "${request.headers.get("Origin") ?? "https://mizu.sh"}/build" to download a custom build`, { status: Status.Forbidden, headers })
   }
   try {
     const options = await request.json()