chrome-devtools-frontend 1.0.971727 → 1.0.972361

package/front_end/ui/legacy/tabbedPane.css

@@ -117,6 +117,7 @@
   height: 26px;
   line-height: 16px;
   white-space: nowrap;
+  cursor: default;
   display: flex;
   align-items: center;
   color: var(--color-text-secondary);

package/package.json

@@ -54,5 +54,5 @@
     "unittest": "scripts/test/run_unittests.py --no-text-coverage",
     "watch": "third_party/node/node.py --output scripts/watch_build.js"
   },
-  "version": "1.0.971727"
+  "version": "1.0.972361"
 }

package/scripts/hosted_mode/server.js

@@ -177,6 +177,19 @@ async function requestHandler(request, response) {
       // This is fine to do given that test invocations run against fresh Chrome profiles.
       headers.set('Cache-Control', 'max-age=3600');
     }
+    if (!headers.get('Access-Control-Allow-Origin')) {
+      // The DevTools frontend in hosted-mode uses regular fetch to get source maps etc.
+      // Disable CORS only for the DevTools frontend, not for resource/target pages.
+      // Since Chrome will cache resources, we have to indicate that CORS can still vary
+      // based on the origin that made the request. E.g. the target page loads a script first
+      // but then DevTools also wants to load it. In the former, we disallow cross-origin requests by default,
+      // while for the latter we allow it.
+      const requestedByDevTools = request.headers.origin?.includes('devtools-frontend.test');
+      if (requestedByDevTools) {
+        headers.set('Access-Control-Allow-Origin', request.headers.origin);
+      }
+      headers.set('Vary', 'Origin');
+    }
     headers.forEach((value, header) => {
       response.setHeader(header, value);
     });