From ea5bd47489f016fce6254d3639fbcdd78db93ada Mon Sep 17 00:00:00 2001 From: xiaoxia Date: Fri, 26 Jun 2026 17:48:57 +0800 Subject: [PATCH] fix(P1-1): resolve CORS configuration security issue --- apps/api/main.py | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/apps/api/main.py b/apps/api/main.py index 865c89184..5507d2a1f 100644 --- a/apps/api/main.py +++ b/apps/api/main.py @@ -30,12 +30,24 @@ app.add_exception_handler(StarletteHTTPException, http_exception_handler) app.add_exception_handler(RequestValidationError, validation_exception_handler) app.add_exception_handler(Exception, general_exception_handler) +# P1-1: Fix CORS configuration security issue +# - allow_credentials=True is incompatible with allow_origins=["*"] +# - In production, only allow configured domains, not "*" +if settings.DEBUG: + allow_origins = settings.CORS_ORIGINS # Allow localhost in debug mode +else: + # In production, filter out any wildcard "*" origins + allow_origins = [origin for origin in settings.CORS_ORIGINS if origin != "*"] + if not allow_origins: + # Default to production domain if no valid origins configured + allow_origins = ["https://xiaoxiajianji.com"] + app.add_middleware( CORSMiddleware, - allow_origins=settings.CORS_ORIGINS, + allow_origins=allow_origins, allow_credentials=True, - allow_methods=["*"], - allow_headers=["*"], + allow_methods=["GET", "POST", "PUT", "DELETE", "OPTIONS"], + allow_headers=["Authorization", "Content-Type"], ) app.add_middleware(GZipMiddleware, minimum_size=1000) app.add_middleware(RequestLoggingMiddleware)