From 8ee54c8b32a1b0cf13c03fc5723142bc62c775f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= Date: Thu, 16 Jul 2026 12:26:51 +0300 Subject: [PATCH] server: Ignore empty / non-existing `Origin` headers (#25756) Otherwise this gives lots of unnecessary warnings: W srv operator(): (CORS) skip non-localhost origin: --- tools/server/server-http.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/server/server-http.cpp b/tools/server/server-http.cpp index 24a38452aa..783b01b82d 100644 --- a/tools/server/server-http.cpp +++ b/tools/server/server-http.cpp @@ -283,9 +283,9 @@ bool server_http_context::init(const common_params & params) { } else if (params.cors_origins == "localhost") { // special case: only reflect the Origin header if it is a localhost origin std::string origin = req.get_header_value("Origin"); - if (origin_is_localhost(origin)) { + if (!origin.empty() && origin_is_localhost(origin)) { res.set_header("Access-Control-Allow-Origin", origin); - } else { + } else if (!origin.empty()) { SRV_WRN("(CORS) skip non-localhost origin: %s\n", origin.c_str()); } } else {