sec-cors-validate Edge Function — Security

sec-cors-validate — Validate CORS origins

Checks a request's Origin header against your allow list and returns the exact CORS headers to set. Supports exact matches, wildcard subdomains, and credential-bearing requests.

---

API

POST /api/sec-cors-validate

Request body

Field	Type	Required	Default	Description
origin	string	✅	—	The Origin header value from the incoming request
allowList	string[]	✅	—	Allowed origins — exact, wildcard (*.example.com), or *
allowCredentials	boolean	❌	false	Whether to allow cookies/credentials

Success response (200)

{
  "success": true,
  "data": {
    "allowed": true,
    "headers": {
      "Access-Control-Allow-Origin": "https://app.example.com",
      "Vary": "Origin",
      "Access-Control-Allow-Credentials": "true"
    }
  }
}

Error responses

Code	HTTP	When
INVALID_INPUT	400	Missing origin or allowList
INTERNAL_ERROR	500	Unexpected error

---

Usage

cURL

curl -X POST "$FUNCTION_URL" \
  -H "Content-Type: application/json" \
  -d '{"origin": "https://app.example.com", "allowList": ["*.example.com"], "allowCredentials": true}'

TypeScript / JavaScript (HTTP)

const response = await fetch(FUNCTION_URL, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    origin: request.headers.get('origin') ?? '',
    allowList: ['https://app.example.com', '*.staging.example.com'],
  }),
});
const { data } = await response.json();
if (data.allowed) {
  for (const [key, value] of Object.entries(data.headers)) {
    response.headers.set(key, value);
  }
}

Direct import (Node / Bun / Deno)

import { corsValidate } from '@aerostack/functions/sec-cors-validate';

const { allowed, headers } = corsValidate({
  origin: req.headers.origin ?? '',
  allowList: ['https://example.com', '*.example.com'],
});

---

Use Cases

• Implementing dynamic CORS middleware that reads allowed origins from a database or config
• Handling multi-tenant SaaS where each tenant has their own allowed origins
• Building API gateways that need to enforce per-endpoint CORS policies
• Validating preflight OPTIONS requests before allowing the actual request

---

Notes

• Wildcard pattern *.example.com matches app.example.com but NOT example.com itself
• The global wildcard * matches any origin — do NOT combine with allowCredentials: true (browsers will reject this)
• When allowed=false, headers is an empty object — do not set any CORS headers
• Always set the Vary: Origin header (included automatically) to prevent caching issues