fix(desktop): restore server CORS policy

packages/desktop/src/main/windows.ts

@@ -208,12 +208,6 @@ export function createMainWindow(id: string = randomUUID()) {
   wireWindowRecovery(win, id)
   wireNavigationPolicy(win)
 
-  win.webContents.session.webRequest.onBeforeSendHeaders((details, callback) => {
-    const { requestHeaders } = details
-    upsertKeyValue(requestHeaders, "Access-Control-Allow-Origin", ["*"])
-    callback({ requestHeaders })
-  })
-
   win.webContents.session.webRequest.onHeadersReceived((details, callback) => {
     const { responseHeaders = {} } = details
     addRendererHeaders(details.url, responseHeaders)
@@ -500,8 +494,6 @@ function isTrustedRendererUrl(value?: string) {
 }
 
 function addRendererHeaders(value: string, headers: Record<string, any>) {
-  upsertKeyValue(headers, "Access-Control-Allow-Origin", ["*"])
-  upsertKeyValue(headers, "Access-Control-Allow-Headers", ["*"])
   if (isRendererUrl(value, true)) upsertKeyValue(headers, documentPolicyHeader, [jsCallStacksDocumentPolicy])
 }
 

packages/server/test/cors.test.ts

@@ -0,0 +1,12 @@
+import { describe, expect, test } from "bun:test"
+import { isAllowedCorsOrigin } from "../src/cors"
+
+describe("CORS origin policy", () => {
+  test("allows the desktop renderer origin", () => {
+    expect(isAllowedCorsOrigin("oc://renderer")).toBe(true)
+  })
+
+  test("rejects other custom protocol origins", () => {
+    expect(isAllowedCorsOrigin("other://renderer")).toBe(false)
+  })
+})