From 33d8fadc8fed710d2d0c7db87d5262137cd2cf18 Mon Sep 17 00:00:00 2001
From: "Namhyeon, Go" <gnh1201@gmail.com>
Date: Sat, 4 Oct 2025 19:39:58 +0900
Subject: [PATCH] Update WelsonJS.Toolkit/WelsonJS.Launcher/ResourceServer.cs

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 WelsonJS.Toolkit/WelsonJS.Launcher/ResourceServer.cs | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/WelsonJS.Toolkit/WelsonJS.Launcher/ResourceServer.cs b/WelsonJS.Toolkit/WelsonJS.Launcher/ResourceServer.cs
index 6da51ac..9119b30 100644
--- a/WelsonJS.Toolkit/WelsonJS.Launcher/ResourceServer.cs
+++ b/WelsonJS.Toolkit/WelsonJS.Launcher/ResourceServer.cs
@@ -522,13 +522,18 @@ namespace WelsonJS.Launcher
                 return true;
             }
 
-            if (allowed.Contains(origin, StringComparer.OrdinalIgnoreCase))
+            // only perform a single, case-sensitive origin check
             if (allowed.Contains(origin, StringComparer.Ordinal))
             {
                 respHeaders["Access-Control-Allow-Origin"] = origin;
                 respHeaders["Access-Control-Allow-Credentials"] = "true";
                 return true;
             }
+            {
+                respHeaders["Access-Control-Allow-Origin"] = origin;
+                respHeaders["Access-Control-Allow-Credentials"] = "true";
+                return true;
+            }
 
             return false;
         }