CORS: crash on missing ALLOWED_ORIGINS + missing Vary header

[nmogil]

Problem

The CORS middleware has a few issues, the most critical being that a missing ALLOWED_ORIGINS env var crashes all requests — likely for anyone self-hosting.

Issues

1. Missing ALLOWED_ORIGINS crashes the worker (P0)

worker/src/middleware/cors.ts:10 calls env.ALLOWED_ORIGINS.split(',') with no fallback. If the env var is unset, every request fails with an unhandled Cannot read properties of undefined error (500). This is a common first-run scenario for self-hosted deployments.

Fix: Add a fallback — default to * with a console.warn, or reject all origins gracefully.

2. Missing Vary: Origin header (P1)

corsHeaders() sets Access-Control-Allow-Origin dynamically based on the request origin but doesn't include Vary: Origin. This can cause cache poisoning if a CDN or shared cache is in front of the worker.

Fix: Add Vary: Origin to the response headers in corsHeaders().

3. Unused cors import from itty-router (P2)

worker/src/index.ts:1 imports cors from itty-router but never uses it (custom implementation is used instead).

Fix: Remove the unused import.

Files

• worker/src/middleware/cors.ts
• worker/src/index.ts