Backend CORS is disabled by default (origin: false), and an unpacked extension's ID isn't fixed/predictable per install anyway, so allowlisting it server-side would be awkward. options.js now calls chrome.permissions.request() for the entered base URL on Save — once granted, the extension's own fetches bypass CORS entirely for that origin. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| options.css | ||
| options.html | ||
| options.js | ||