edge-function-cors-hardener

Restrict CORS origins by creating a shared module that validates requests against an ALLOWED_ORIGINS list, removing permissive '*' wildcard settings. This ensures only specified domains can access your Edge Functions like generate-pdf, send-email, and upsert-lead, blocking unauthorized cross-origin requests.

Wildcard CORS policies allow any origin to access your functions, creating security vulnerabilities. Restricting to specific allowed origins prevents unauthorized clients from making requests and reduces attack surface for sensitive operations like PDF generation or data upsertion.

Handle CORS preflight by returning a 204 response with appropriate CORS headers for OPTIONS requests. A centralized CORS module computes restricted headers and validates origins, ensuring proper preflight handling before actual requests reach your function logic.

Yes, create a shared module in supabase/functions/_shared/cors.ts that computes restricted headers and validates origins. Update each Edge Function to import and use this centralized configuration, ensuring consistent CORS policies across generate-pdf, send-email, upsert-lead, and other functions.

Configure ALLOWED_ORIGIN as an environment variable and deploy using mcp_supabase. The shared CORS module reads this configuration to validate incoming requests, allowing you to manage allowed origins without modifying function code.

After deploying with configured ALLOWED_ORIGINS and hardened CORS headers, test from your frontend domain. Verify that requests from allowed origins succeed with proper headers attached to JSON responses, while requests from unauthorized origins are blocked at the preflight stage.