mirror of
https://github.com/lfnovo/open-notebook.git
synced 2026-08-04 05:12:52 +00:00
fd7dee7ced
* fix: don't combine wildcard CORS origins with allow_credentials Combining allow_origins=["*"] with allow_credentials=True makes Starlette's CORSMiddleware reflect the request's Origin header verbatim instead of returning a literal "*" (browsers reject a literal wildcard alongside credentials) - defeating the origin allowlist for any credentialed request. allow_credentials is now tied to whether CORS_ORIGINS was explicitly scoped: False for the default wildcard, True once an operator opts into specific origins. _cors_headers() (the manual CORS builder for error responses raised before CORSMiddleware runs) is updated to match, so it can't grant credentials the real middleware wouldn't. Not independently exploitable today (the frontend never sends credentialed requests, and auth is a Bearer header, not a cookie), but there's no reason to allow it for the default wildcard case. * fix: key allow_credentials on the parsed origins list, not the env var An operator who explicitly sets CORS_ORIGINS=* got allow_credentials=True with a wildcard origin list - the exact reflect-any-Origin behavior this change exists to prevent. Introduce CORS_ALLOW_CREDENTIALS keyed on the parsed list containing '*' and use it at both the middleware registration and the manual error-response headers; replace the tautological formula tests with ones exercising the real parser. --------- Co-authored-by: Luis Novo <lfnovo@gmail.com> |
||
|---|---|---|
| .. | ||
| routers | ||
| __init__.py | ||
| auth.py | ||
| chat_service.py | ||
| CLAUDE.md | ||
| client.py | ||
| command_service.py | ||
| context_service.py | ||
| credentials_service.py | ||
| embedding_service.py | ||
| episode_profiles_service.py | ||
| insights_service.py | ||
| main.py | ||
| models.py | ||
| models_service.py | ||
| notebook_service.py | ||
| notes_service.py | ||
| podcast_api_service.py | ||
| podcast_service.py | ||
| search_service.py | ||
| settings_service.py | ||
| sources_service.py | ||
| transformations_service.py | ||