CORS Allowed Origins Settings Block for React

Edit SAVED at the top: each origin has an id, an environment tag and an address, and the policy has a credentials flag and a max age in seconds. RULES names the four checks and what each says while it passes, and findingOf holds what each reports when it fails. The counts, the Fix labels and the sentences under the policy controls are all worked out from the list, so nothing is typed twice.

A wildcard origin is an origin that is *; its fix removes it. An insecure origin is a Production origin on plain http that isn't localhost; its fix rewrites each to https and drops duplicates. A localhost origin in Production is a localhost or 127.0.0.1 address tagged Production; its fix tags it Local. A wildcard with credentials is * listed while credentials are on, which browsers refuse; its fix turns credentials off. A passing check keeps its place and says so, and its button stays on the row as a quiet "Passes", so focus and height never move when you fix something.

An origin is a scheme and a host, with an optional port: https://app.example.com or http://localhost:3000. It refuses a missing scheme, anything after the host (a path, a query or a fragment), a wildcard that isn't a leading *. and an address already on the list, and it says which in the field's message, keeping the text so you can fix it. A lone * is allowed on purpose, so you can see the first check complain. Enter adds the origin without saving the form.

Everything. Nothing is enforced, saved or requested: the origins, the fixes and the policy live in this page's state, and Save only says what it kept. To make it real, send the saved list to your API and have it answer preflights from it, then keep running the same checks on the server so an unsafe list can't be saved by another route. Saving with checks still failing is allowed here, and the status line says how many.

Credentials say whether browsers may send cookies and sign-in headers across origins; the sentence under the switch says what that means for this list, including when a wildcard makes browsers refuse them. The number is how long a browser may reuse a preflight answer, 0 to 86,400 seconds, and the sentence turns it into minutes or hours and notes that Chrome keeps a preflight at most two hours. A value outside the range is refused when you save, with focus on the field. The number field commits when you leave it or press Enter on some libraries, so type, then move on.