fix: Fix CORS allowOrigin silently leaks configured origin on mismatch (#74)

[KochC]

Summary

Changed corsHeaders() to return the string "null" (instead of the configured origin) when the request's Origin header does not match OPENCODE_LLM_PROXY_CORS_ORIGIN, ensuring browsers block cross-origin requests from unrecognised origins.

Closes #74

Diff

diff --git a/index.js b/index.js
index d55980c..b14e412 100644
--- a/index.js
+++ b/index.js
@@ -16,7 +16,7 @@ function corsHeaders(request) {
   const requestedMethod = request?.headers.get("access-control-request-method")
   const requestedPrivateNetwork = request?.headers.get("access-control-request-private-network")
   const requestOrigin = request?.headers.get("origin") ?? ""
-  const allowOrigin = configuredOrigin === "*" ? "*" : (requestOrigin === configuredOrigin ? requestOrigin : configuredOrigin)
+  const allowOrigin = configuredOrigin === "*" ? "*" : (requestOrigin === configuredOrigin ? requestOrigin : "null")
 
   const headers = {
     vary: "origin, access-control-request-method, access-control-request-headers",
diff --git a/index.test.js b/index.test.js
index 49d5130..29b0774 100644
--- a/index.test.js
+++ b/index.test.js
@@ -162,14 +162,14 @@ test("health response includes CORS headers", async () => {
   assert.deepEqual(body, { healthy: true, service: "opencode-openai-proxy" })
 })
 
-test("configured origin is returned for normal requests", async () => {
+test("configured origin is returned when request origin matches", async () => {
   process.env.OPENCODE_LLM_PROXY_CORS_ORIGIN = "https://console.example.com"
 
   try {
     const handler = createProxyFetchHandler(createClient())
     const request = new Request("http://127.0.0.1:4010/health", {
       headers: {
-        Origin: "https://app.example.com",
+        Origin: "https://console.example.com",
       },
     })
 
@@ -181,7 +181,7 @@ test("configured origin is returned for normal requests", async () => {
   }
 })
 
-test("disallowed origin does not receive its own origin back", async () => {
+test("disallowed origin receives null, not the configured or request origin", async () => {
   process.env.OPENCODE_LLM_PROXY_CORS_ORIGIN = "https://allowed.example.com"
 
   try {
@@ -192,9 +192,10 @@ test("disallowed origin does not receive its own origin back", async () => {
 
     const response = await handler(request)
 
-    // The header must be the configured origin, not the request's origin
-    assert.equal(response.headers.get("access-control-allow-origin"), "https://allowed.example.com")
+    // Must return "null" to explicitly deny cross-origin access for unrecognised origins
+    assert.equal(response.headers.get("access-control-allow-origin"), "null")
     assert.notEqual(response.headers.get("access-control-allow-origin"), "https://evil.example.com")
+    assert.notEqual(response.headers.get("access-control-allow-origin"), "https://allowed.example.com")
   } finally {
     delete process.env.OPENCODE_LLM_PROXY_CORS_ORIGIN
   }
@@ -211,7 +212,7 @@ test("request with no Origin header is handled gracefully", async () => {
   assert.equal(response.headers.get("access-control-allow-origin"), "*")
 })
 
-test("OPTIONS preflight for disallowed origin returns configured origin, not request origin", async () => {
+test("OPTIONS preflight for disallowed origin returns null, not the configured or request origin", async () => {
   process.env.OPENCODE_LLM_PROXY_CORS_ORIGIN = "https://allowed.example.com"
 
   try {
@@ -227,8 +228,10 @@ test("OPTIONS preflight for disallowed origin returns configured origin, not requ
     const response = await handler(request)
 
     assert.equal(response.status, 204)
-    assert.equal(response.headers.get("access-control-allow-origin"), "https://allowed.example.com")
+    // Must return "null" to explicitly deny preflight for unrecognised origins
+    assert.equal(response.headers.get("access-control-allow-origin"), "null")
     assert.notEqual(response.headers.get("access-control-allow-origin"), "https://evil.example.com")
+    assert.notEqual(response.headers.get("access-control-allow-origin"), "https://allowed.example.com")
   } finally {
     delete process.env.OPENCODE_LLM_PROXY_CORS_ORIGIN
   }

---

Automated fix by OpenCode Agent