CORS & Crawler Policy
Understand the separate CORS behaviour for static image files and the package-free JSON URL resolver, plus the documentation crawler policy.
Static asset CORS allowlist
The Cloudflare Pages _headers file configures this exact origin for static responses:
https://softhoursdiary.pages.devThis applies to static files such as emoji and flag images, the standalone browser helper and documentation. An origin includes the scheme and hostname, but not a trailing slash.
JSON API CORS behaviour
The versioned endpoint /api/v1/asset is handled by a Cloudflare Pages Function, not by the static _headers file. Its response explicitly sends:
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Access-Control-Allow-Headers: Accept, Content-TypeThe wildcard is limited to this public, read-only resolver. It returns only a public image URL, uses no credentials and contains no user-specific data. The static image-file allowlist remains unchanged.
When CORS is needed
Displaying an image through an ordinary HTML img element does not require JavaScript to read the cross-origin response. CORS matters when browser code uses fetch() or reads image pixels from a canvas. The JSON resolver is designed for cross-origin fetch; direct static file responses retain the exact website-origin policy.
Pages Function routing
The API implementation lives at functions/api/v1/asset.js. The root _routes.json includes only /api/v1/*, so static emoji, flag, documentation and helper-file requests do not invoke the Function.
Pages Functions must set CORS headers in their own responses. Static _headers rules do not configure Function-generated responses.
Documentation crawler policy
The documentation tree remains indexable. The robots.txt policy asks crawlers to avoid raw asset folders and the JSON resolver route. Asset responses and API responses also carry X-Robots-Tag: noindex, nofollow, nosnippet.
Robots directives are advisory, not access control. The asset files remain public and can still be requested directly.
Verify the behaviour
curl -i "https://softhoursdiary-emojis.pages.dev/[api/v1/asset?type=emoji&id=1f632&quality=svg"
curl -i -X OPTIONS "https://softhoursdiary-emojis.pages.dev/[api/v1/asset"After the Pages deployment finishes, confirm that GET returns JSON, OPTIONS returns 204, and the Function response includes its own CORS headers.