Add Access-Control-Max-Age header on CORS preflight (v0.6.4)

New corsMaxAge option in HttpHandlerOptions sets Access-Control-Max-Age on
OPTIONS responses. Default is 7200 seconds (2 hours). Pass null to omit.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: rustyconover

.playwright-mcp/console-2026-02-22T16-42-00-808Z.log

@@ -0,0 +1 @@
+[     952ms] [WARNING] Mixed Content: The page at 'https://www.google.com/search?q=ll&oq=ll&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQRRg8MgYIAhBFGDwyBggDEEUYPNIBBzEyM2owajKoAgCwAgA&sourceid=chrome&ie=UTF-8&sei=2TGbaddx0uLk2g_l8f34Dw' was loaded over HTTPS, but requested an insecure element 'http://img.youtube.com/vi/mzZ2J58YSaM/hqdefault.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html @ https://www.google.com/search?q=ll&oq=ll&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQRRg8MgYIAhBFGDwyBggDEEUYPNIBBzEyM2owajKoAgCwAgA&sourceid=chrome&ie=UTF-8&sei=2TGbaddx0uLk2g_l8f34Dw:0

.playwright-mcp/console-2026-02-22T16-47-17-997Z.log

@@ -0,0 +1 @@
+[      86ms] [ERROR] Failed to load resource: the server responded with a status of 404 (File not found) @ http://127.0.0.1:18923/favicon.ico:0

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+  "python-envs.pythonProjects": []
+}

__pycache__/test_ts_conformance.cpython-313-pytest-9.0.2.pyc

@@ -1,6 +1,6 @@
 {
   "name": "@query-farm/vgi-rpc",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "license": "Apache-2.0",
   "homepage": "https://vgi-rpc-typescript.query.farm",
   "repository": {

package.json

@@ -42,6 +42,7 @@ export function createHttpHandler(
   const signingKey = options?.signingKey ?? randomBytes(32);
   const tokenTtl = options?.tokenTtl ?? 3600;
   const corsOrigins = options?.corsOrigins;
+  const corsMaxAge = options?.corsMaxAge === undefined ? 7200 : options.corsMaxAge;
   const maxRequestBytes = options?.maxRequestBytes;
   const maxStreamResponseBytes = options?.maxStreamResponseBytes;
   const serverId = options?.serverId ?? crypto.randomUUID().replace(/-/g, "").slice(0, 12);
@@ -81,12 +82,15 @@ export function createHttpHandler(
     externalLocation,
   };
 
-  function addCorsHeaders(headers: Headers): void {
+  function addCorsHeaders(headers: Headers, isOptions = false): void {
     if (corsOrigins) {
       headers.set("Access-Control-Allow-Origin", corsOrigins);
       headers.set("Access-Control-Allow-Methods", "POST, OPTIONS");
       headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization");
       headers.set("Access-Control-Expose-Headers", "WWW-Authenticate, X-Request-ID, X-VGI-Content-Encoding");
+      if (isOptions && corsMaxAge != null) {
+        headers.set("Access-Control-Max-Age", String(corsMaxAge));
+      }
     }
   }
 
@@ -132,7 +136,7 @@ export function createHttpHandler(
     if (request.method === "OPTIONS") {
       if (path === `${prefix}/__capabilities__`) {
         const headers = new Headers();
-        addCorsHeaders(headers);
+        addCorsHeaders(headers, true);
         if (maxRequestBytes != null) {
           headers.set("VGI-Max-Request-Bytes", String(maxRequestBytes));
         }
@@ -141,7 +145,7 @@ export function createHttpHandler(
 
       if (corsOrigins) {
         const headers = new Headers();
-        addCorsHeaders(headers);
+        addCorsHeaders(headers, true);
         return new Response(null, { status: 204, headers });
       }
 

src/http/handler.ts

@@ -15,6 +15,8 @@ export interface HttpHandlerOptions {
   tokenTtl?: number;
   /** CORS allowed origins. If set, CORS headers are added to all responses. */
   corsOrigins?: string;
+  /** Access-Control-Max-Age value in seconds for preflight OPTIONS responses. Default: 7200 (2 hours). null omits the header. */
+  corsMaxAge?: number | null;
   /** Maximum request body size in bytes. Advertised via VGI-Max-Request-Bytes header. */
   maxRequestBytes?: number;
   /** Maximum bytes before a producer stream emits a continuation token. */

src/http/types.ts

@@ -338,6 +338,60 @@ describe("HTTP Handler", () => {
     );
   });
 
+  test("CORS preflight includes Access-Control-Max-Age by default", async () => {
+    const handlerWithCors = createHttpHandler(makeTestProtocol(), {
+      prefix: "/vgi",
+      corsOrigins: "*",
+    });
+
+    const res = await handlerWithCors(new Request(`${BASE}/vgi/add`, { method: "OPTIONS" }));
+    expect(res.headers.get("Access-Control-Max-Age")).toBe("7200");
+  });
+
+  test("CORS preflight custom corsMaxAge", async () => {
+    const handlerWithCors = createHttpHandler(makeTestProtocol(), {
+      prefix: "/vgi",
+      corsOrigins: "*",
+      corsMaxAge: 3600,
+    });
+
+    const res = await handlerWithCors(new Request(`${BASE}/vgi/add`, { method: "OPTIONS" }));
+    expect(res.headers.get("Access-Control-Max-Age")).toBe("3600");
+  });
+
+  test("CORS preflight corsMaxAge=null omits header", async () => {
+    const handlerWithCors = createHttpHandler(makeTestProtocol(), {
+      prefix: "/vgi",
+      corsOrigins: "*",
+      corsMaxAge: null,
+    });
+
+    const res = await handlerWithCors(new Request(`${BASE}/vgi/add`, { method: "OPTIONS" }));
+    expect(res.headers.get("Access-Control-Max-Age")).toBeNull();
+  });
+
+  test("Access-Control-Max-Age not set on non-OPTIONS", async () => {
+    const handlerWithCors = createHttpHandler(makeTestProtocol(), {
+      prefix: "/vgi",
+      corsOrigins: "*",
+      serverId: "max-age-test",
+    });
+
+    const paramSchema = new Schema([new Field("a", new Float64(), false), new Field("b", new Float64(), false)]);
+    const body = buildRequestIpc(paramSchema, { a: [1], b: [2] }, "add");
+
+    const res = await handlerWithCors(
+      new Request(`${BASE}/vgi/add`, {
+        method: "POST",
+        headers: { "Content-Type": ARROW_CONTENT_TYPE },
+        body,
+      }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get("Access-Control-Max-Age")).toBeNull();
+  });
+
   // -- Producer stream --
 
   test("producer stream init", async () => {