mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-18 04:42:30 +03:00
602df4d51d
open-sse/translator/response/openai-to-gemini-sse.ts hardcoded Access-Control-Allow-Origin: "*" at six response sites (SSE success path and five JSON response paths). The centralized fail-closed CORS gate (applyCorsHeaders in src/server/cors/origins.ts) does run on this route but only ever sets the header when it resolves an allowed origin — it never clears a header a route handler already wrote. So the hardcoded wildcard survived untouched for anonymous, credential-less requests on the default REQUIRE_API_KEY=false install, letting any cross-origin page read completion bodies via fetch(). Removes all six hardcoded literals so applyCorsHeaders is the sole source of the header, matching every other route on this surface.