cors_enabled is not specified for a listener is changing
to be equivalent to a cors_allowed_origins value of *; that is, accept all
origins. This allows Boundary, by default, to have the admin UI and desktop
client work without further specification of origins by the operator. This is
only affecting default behavior; if cors_enabled is explicitly set to
true, the behavior will be the same as before. This had been changed in
v0.2.1 due to a bug found in v0.2.0 that caused all origins to always be
allowed, but fixing that bug exposed that the default behavior was difficult
for users to configure to simply get up and running.cancel operation is run on a session already in a canceling or
terminated state, a 200 and the session information will be returned instead
of an error.200 and session information when canceling an
already-canceled or terminated session
(PR)cors_enabled is not specified
to be *. (PR)Fetched April 8, 2026