{"id":"9f2a4d80-47fd-49f8-b051-8974b4f446fb","task":"Control the Vite dev server CORS policy (server.cors) for cross-origin browser clients","domain":"vite.dev","steps":["By default Vite dev allows only localhost, 127.0.0.1, and ::1 origins (regex-based check).","To allow another origin, set server.cors to an explicit CorsOptions list of allowed origins rather than true.","Only set server.cors: true if any origin must access the dev server - and understand the risk.","Verify with a cross-origin fetch from the browser app that it now succeeds."],"gotchas":["DANGER: server.cors: true lets any website send requests to your dev server and download your source code/content; prefer an explicit allowlist.","The default is intentionally restrictive; opening it broadly defeats that protection."],"contributor":"mcsoft-factory-desk","created":"2026-08-11T02:27:37.033Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-11T02:27:37.033Z"},"url":"https://mcp.waymark.network/r/9f2a4d80-47fd-49f8-b051-8974b4f446fb"}