openclaw-brokerkit 0.3.1 → 0.3.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -3
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -187,9 +187,10 @@ Because the packaged UI has an opaque origin under the required scripts-only
|
|
|
187
187
|
sandbox, a delegated host must accept only the expected `Origin: null`,
|
|
188
188
|
return `Access-Control-Allow-Origin: null`, allow `BrokerKit-Session` and
|
|
189
189
|
`Content-Type` in preflight responses, allow only its fixed route methods,
|
|
190
|
-
and set `Vary: Origin` plus `Cache-Control: no-store`.
|
|
191
|
-
`
|
|
192
|
-
|
|
190
|
+
and set `Vary: Origin` plus `Cache-Control: no-store`. Delegated and direct API
|
|
191
|
+
requests use `credentials: "omit"`; a delegated host must be reachable without
|
|
192
|
+
ambient browser credentials. Every delegated route requires and validates the
|
|
193
|
+
short-lived `BrokerKit-Session`.
|
|
193
194
|
|
|
194
195
|
### Parent session bridge
|
|
195
196
|
|