Summary

The Rsbuild dev server unexpectedly set Access-Control-Allow-Origin to * by default, which caused the server.cors option not to work as expected and introduced security risks.

This PR removes the default Access-Control-Allow-Origin: * and strictly enables CORS according to the value of server.cors.

This may break users who are using Module Federation or proxy tools, so I added compatibility code for Module Federation.

Migration

To enable CORS, set server.cors to true:

export default {
  server: {
    cors: true,
  },
};

Related Links

• fix(rsbuild-plugin): explicitly setting CORS headers module-federation/core#3635
• GHSA-vg6x-rcgg-rjx6

Checklist

• Tests updated (or not required).
• Documentation updated (or not required).