openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-22 03:35:29 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

[PR #94] [CLOSED] feat(api): add CORS headers for browser clients #254

New Issue
Closed
opened 2026-02-15 17:16:31 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:31 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/openclaw/clawhub/pull/94
Author: @MaudeBot
Created: 2/1/2026
Status: ❌ Closed

Base: main ← Head: feat/cors-headers

📝 Commits (1)

  • 29e8ec2 feat(api): add CORS headers for browser clients

📊 Changes

5 files changed (+49 additions, -4 deletions)

View changed files

📝 convex/downloads.ts (+6 -4)
📝 convex/http.ts (+12 -0)
📝 convex/httpApi.ts (+3 -0)
📝 convex/httpApiV1.ts (+5 -0)
➕ convex/lib/cors.ts (+23 -0)

📄 Description

Summary

Adds CORS headers to all API endpoints, enabling browser-based clients to fetch skills directly from the ClawHub API.

Motivation

Browser-based tools like Cove (OpenClaw WebUI) want to display and install skills from ClawHub. Currently, browsers block these requests due to missing CORS headers.

This is standard practice for public package registries — npm, crates.io, and PyPI all allow cross-origin requests.

Changes

  • convex/lib/cors.ts — Shared CORS headers and preflight response helper
  • convex/http.ts — Single OPTIONS handler for all /api/* routes
  • convex/httpApi.ts — CORS headers in json/text response helpers
  • convex/httpApiV1.ts — CORS headers in json/text helpers + file content endpoints
  • convex/downloads.ts — CORS headers on download responses

Headers Added

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 86400

Safety

  • Additive only — Existing CLI/server clients ignore these headers
  • Auth unchanged — Protected endpoints still require Bearer tokens
  • No credentials mode — Not setting Allow-Credentials, so cookies aren't sent
  • Standard pattern — Identical to other public package registries

Greptile Overview

Greptile Summary

Adds CORS headers across all API endpoints to enable browser-based clients to fetch skills from ClawHub. The implementation is clean and additive - existing CLI/server clients will ignore these headers, and authentication still requires Bearer tokens for protected endpoints.

Key changes:

  • Created shared convex/lib/cors.ts module with standard CORS headers and preflight handler
  • Added CORS headers to all JSON/text response helpers in httpApi.ts and httpApiV1.ts
  • Added CORS headers to download endpoint responses in downloads.ts
  • Registered OPTIONS preflight handler for /api/* routes in http.ts

The approach follows standard patterns used by public package registries like npm and crates.io. No security concerns since Access-Control-Allow-Credentials is not set, so cookies/credentials won't be sent in cross-origin requests.

Confidence Score: 4/5

  • This PR is safe to merge with low risk
  • The implementation is additive and well-structured, following standard CORS patterns. Auth remains unchanged with Bearer tokens still required. However, two minor issues flagged in previous review threads (OPTIONS handler scope and narrow Allow-Headers list) could cause preflight failures for some legitimate browser requests, warranting minor attention before merge.
  • Previous review comments on convex/http.ts:199 and convex/lib/cors.ts:8 should be addressed to ensure comprehensive CORS coverage

Last reviewed commit: 29e8ec2

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/openclaw/clawhub/pull/94 **Author:** [@MaudeBot](https://github.com/MaudeBot) **Created:** 2/1/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `feat/cors-headers` --- ### 📝 Commits (1) - [`29e8ec2`](https://github.com/openclaw/clawhub/commit/29e8ec2baee5bd7993ee7c5282cc934ca499057e) feat(api): add CORS headers for browser clients ### 📊 Changes **5 files changed** (+49 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `convex/downloads.ts` (+6 -4) 📝 `convex/http.ts` (+12 -0) 📝 `convex/httpApi.ts` (+3 -0) 📝 `convex/httpApiV1.ts` (+5 -0) ➕ `convex/lib/cors.ts` (+23 -0) </details> ### 📄 Description ## Summary Adds CORS headers to all API endpoints, enabling browser-based clients to fetch skills directly from the ClawHub API. ## Motivation Browser-based tools like [Cove](https://github.com/maudecode/cove) (OpenClaw WebUI) want to display and install skills from ClawHub. Currently, browsers block these requests due to missing CORS headers. This is standard practice for public package registries — npm, crates.io, and PyPI all allow cross-origin requests. ## Changes - **`convex/lib/cors.ts`** — Shared CORS headers and preflight response helper - **`convex/http.ts`** — Single OPTIONS handler for all `/api/*` routes - **`convex/httpApi.ts`** — CORS headers in json/text response helpers - **`convex/httpApiV1.ts`** — CORS headers in json/text helpers + file content endpoints - **`convex/downloads.ts`** — CORS headers on download responses ## Headers Added ``` Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, DELETE, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Max-Age: 86400 ``` ## Safety - **Additive only** — Existing CLI/server clients ignore these headers - **Auth unchanged** — Protected endpoints still require Bearer tokens - **No credentials mode** — Not setting `Allow-Credentials`, so cookies aren't sent - **Standard pattern** — Identical to other public package registries <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> Adds CORS headers across all API endpoints to enable browser-based clients to fetch skills from ClawHub. The implementation is clean and additive - existing CLI/server clients will ignore these headers, and authentication still requires Bearer tokens for protected endpoints. Key changes: - Created shared `convex/lib/cors.ts` module with standard CORS headers and preflight handler - Added CORS headers to all JSON/text response helpers in `httpApi.ts` and `httpApiV1.ts` - Added CORS headers to download endpoint responses in `downloads.ts` - Registered OPTIONS preflight handler for `/api/*` routes in `http.ts` The approach follows standard patterns used by public package registries like npm and crates.io. No security concerns since `Access-Control-Allow-Credentials` is not set, so cookies/credentials won't be sent in cross-origin requests. <h3>Confidence Score: 4/5</h3> - This PR is safe to merge with low risk - The implementation is additive and well-structured, following standard CORS patterns. Auth remains unchanged with Bearer tokens still required. However, two minor issues flagged in previous review threads (OPTIONS handler scope and narrow Allow-Headers list) could cause preflight failures for some legitimate browser requests, warranting minor attention before merge. - Previous review comments on `convex/http.ts:199` and `convex/lib/cors.ts:8` should be addressed to ensure comprehensive CORS coverage <sub>Last reviewed commit: 29e8ec2</sub> <!-- greptile_other_comments_section --> <!-- /greptile_comment --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 17:16:31 -05:00
yindo closed this issue 2026-02-15 17:16:31 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#254
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?