25656cef67
GET requests to the same origin don't send the `origin` headers. in other situations we care about (CORS requests) we want to block unknown origins, but if the origin header is missing it's probably because this is a same-origin request, so we should allow it. Fixes an issue loading bookmarks on mobile devices ### Change type - [x] `bugfix` |
||
---|---|---|
.. | ||
apps-script | ||
bemo-worker | ||
docs | ||
dotcom | ||
dotcom-asset-upload | ||
dotcom-worker | ||
examples | ||
health-worker | ||
huppy | ||
images.tldraw.xyz | ||
vscode |