docs: state what the validator refuses and why methods stay broad

backend/windmill-api/src/triggers/http/handler.rs

@@ -286,9 +286,10 @@ async fn conditional_cors_middleware(
 
     if !not_insert_methods {
         // A route accepts exactly one method, so advertising all seven
-        // overstates it — but only routes under an allowlist get the narrower
-        // answer. An unrestricted route must respond exactly as it did before
-        // this existed.
+        // overstates it. Only a route under an allowlist gets the narrower
+        // answer; an unrestricted one advertises the full supported set, since
+        // narrowing it would say something about a route the response is not
+        // otherwise willing to disclose.
         let restricted_method = match &decision {
             CorsDecision::Restricted { route_method, .. } => *route_method,
             _ => None,

backend/windmill-trigger-http/src/lib.rs

@@ -727,8 +727,10 @@ mod tests {
     #[test]
     fn test_validate_allowed_origins_accepts_anything_comparable() {
         // A shape that cannot match simply matches nothing, so it is the
-        // editor's job to warn and not this one's to refuse. Only `null` and
-        // values that are not header-comparable are rejected.
+        // editor's job to warn and not this one's to refuse. What is refused is
+        // narrower: `null`, values that are not header-comparable, entries that
+        // cannot round-trip the editor's comma-separated field, and lists past
+        // the size a request can afford to scan.
         let allowed = vec![
             "https://app.example.com".to_string(),
             "http://localhost:3000".to_string(),