Repository navigation
docs(saas-api): name the X-CacheKit-* response headers CORS exposes (LAB-12286) - #226
Conversation
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
CORS response header exposure spec/saas-api.md |
The specification names the two exposed response headers and states that the freshness headers are not exposed. It retains the restriction on X-CacheKit-* request headers and the resulting exclusion of ck_sdk_ keys from cross-origin use. |
Estimated code review effort: 1 (Trivial) | ~3 minutes
Change: Other
Merge Risk: 
d6ed4
-
The PR only clarifies documented CORS response-header exposure; it is mergeable as reviewed.
Pre-merge checks: 
-
Check name Status Explanation Title check The title clearly and concisely identifies the documentation change to name the X-CacheKit response headers exposed by CORS. Description check The description directly explains the CORS documentation change and identifies both the exposed and unexposed response headers. Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Finishing Touches
-
Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
@kody start-review |
spec/saas-api.mdsaid the deployed CORS policy "exposes noX-CacheKit-*response header". It exposes two,X-CacheKit-LimiterandX-CacheKit-Deny-Reason, besideRetry-Afterand theRateLimit-*headers. It does not expose the freshness headers,X-CacheKit-FreshnessandX-CacheKit-Fresh-For.The sentence now names what is exposed and what is not. Its conclusion is unchanged: freshness headers stay unreadable cross-origin,
ck_sdk_keys still cannot be used there, and no key class is intended for browser code.