edge-function-cors-hardener

Restrict CORS origins in Supabase Edge Functions with a shared module.

Updated Oct 16, 2025

Search Tags:#security #supabase #http #cors #edge-functions

Ready to run

npx skills add https://github.com/sanchezx1/v0-fullcolor-cotizador --skill edge-function-cors-hardener

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: edge-function-cors-hardener
Source: https://github.com/sanchezx1/v0-fullcolor-cotizador/tree/main/.claude/skills/edge-function-cors-hardener
Command: npx skills add https://github.com/sanchezx1/v0-fullcolor-cotizador --skill edge-function-cors-hardener

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Implementa CORS restrictivo en Edge Functions de Supabase para evitar orígenes no permitidos y aumentar la seguridad.

Core Features & Use Cases

Shared allowed origins: Crear módulo en supabase/functions/_shared/cors.ts con orígenes permitidos.
Edge Functions updates: Actualizar funciones para usar los encabezados CORS centralizados.
Deployment: Desplegar con mcp_supabase y configurar ALLOWED_ORIGIN en el entorno.

Quick Start

Crear el módulo CORS compartido, actualizar las Edge Functions (generate-pdf, send-email, upsert-lead) para usar el módulo, configurar ALLOWED_ORIGIN y desplegar para probar desde el frontend.

Frequently Asked Questions about edge-function-cors-hardener

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I restrict CORS origins in Supabase Edge Functions?▼

Restrict CORS origins by creating a shared module that validates requests against an ALLOWED_ORIGINS list, removing permissive '*' wildcard settings. This ensures only specified domains can access your Edge Functions like generate-pdf, send-email, and upsert-lead, blocking unauthorized cross-origin requests.

Why should I remove wildcard CORS policies from Edge Functions?▼

Wildcard CORS policies allow any origin to access your functions, creating security vulnerabilities. Restricting to specific allowed origins prevents unauthorized clients from making requests and reduces attack surface for sensitive operations like PDF generation or data upsertion.

How do I handle CORS preflight requests in Supabase Edge Functions?▼

Handle CORS preflight by returning a 204 response with appropriate CORS headers for OPTIONS requests. A centralized CORS module computes restricted headers and validates origins, ensuring proper preflight handling before actual requests reach your function logic.

Can I share CORS configuration across multiple Edge Functions?▼

Yes, create a shared module in supabase/functions/_shared/cors.ts that computes restricted headers and validates origins. Update each Edge Function to import and use this centralized configuration, ensuring consistent CORS policies across generate-pdf, send-email, upsert-lead, and other functions.

What environment setup is needed to deploy hardened CORS settings?▼

Configure ALLOWED_ORIGIN as an environment variable and deploy using mcp_supabase. The shared CORS module reads this configuration to validate incoming requests, allowing you to manage allowed origins without modifying function code.

How do I test CORS restrictions from my frontend?▼

After deploying with configured ALLOWED_ORIGINS and hardened CORS headers, test from your frontend domain. Verify that requests from allowed origins succeed with proper headers attached to JSON responses, while requests from unauthorized origins are blocked at the preflight stage.