fix(security): restrict credentialed CORS to trusted origins - #520
Open
ARDA7787 wants to merge 5 commits into
Open
fix(security): restrict credentialed CORS to trusted origins#520ARDA7787 wants to merge 5 commits into
ARDA7787 wants to merge 5 commits into
Conversation
Add isTrustedBrowserOrigin function for CORS handling
Updated CORS configuration to use isTrustedBrowserOrigin for self-hosted setups.
Clarify description of trusted origins in .env.example
Author
|
recheck |
|
I have read the CLA Document and I hereby sign the CLA You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot. |
Author
|
I have read the CLA Document and I hereby sign the CLA. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I have read the CONTRIBUTING.md file.
YES
What kind of change does this PR introduce?
Bug fix (security hardening), plus tests and a docs/env-comment update.
What is the current behavior?
app.ts configures CORS with credentials: true and, on self-host, an origin callback that echoes the request back:
origin: IS_CLOUD ? [appUrl] : (origin) => origin,
What is the new behavior?
Self-host CORS now uses the auth layer’s trusted-origin set via isTrustedBrowserOrigin, with unlisted origins receiving no Access-Control-Allow-Origin header and no new configuration required.