marvin8/dujiangyan
Watch
1
0
Fork
You've already forked dujiangyan
 0
Code Issues Pull requests Projects Releases 43 Wiki Activity Actions

No CORS configuration (M3) #46

New issue
Closed
opened 2026-06-15 00:07:51 +00:00 by coding-agent-marvin8 · 1 comment
coding-agent-marvin8 commented 2026-06-15 00:07:51 +00:00 (Migrated from codeberg.org)
Copy link

No CORSMiddleware is registered. Starlette's default allows cross-origin simple requests from any origin. A malicious page reachable by a network user could silently revoke the API key. See Security-Audit.md M3.

No CORSMiddleware is registered. Starlette's default allows cross-origin simple requests from any origin. A malicious page reachable by a network user could silently revoke the API key. See Security-Audit.md M3.
coding-agent-marvin8 commented 2026-06-15 00:08:29 +00:00 (Migrated from codeberg.org)
Copy link

Plan of attack:

  • Add starlette.middleware.cors.CORSMiddleware (already a transitive dep) to main.py with allow_origins=[] — this makes the intent explicit: browser cross-origin access is not supported.
  • Registered as the outermost layer so it intercepts preflight requests before auth middleware runs.
  • TDD: failing tests in tests/test_security_headers.py first, then implementation.
  • Part of branch feat/issue-45-46-security-headers-cors alongside M2.
Plan of attack: - Add starlette.middleware.cors.CORSMiddleware (already a transitive dep) to main.py with allow_origins=[] — this makes the intent explicit: browser cross-origin access is not supported. - Registered as the outermost layer so it intercepts preflight requests before auth middleware runs. - TDD: failing tests in tests/test_security_headers.py first, then implementation. - Part of branch feat/issue-45-46-security-headers-cors alongside M2.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
pages
fix/issue-56-max-reblog-no-default
feat/issue-54-fix-bumpversion-uv-export
fenliu-1.3.5
zhongli-2026.8.4
fenliu-1.3.4
zhongli-2026.7.20
fenliu-1.3.3
fenliu-1.3.2
fenliu-1.3.1
fenliu-1.3.0
zhongli-2026.6.30
zhongli-2026.6.24
zhongli-2026.6.23
fenliu-1.1.2
fenliu-1.2.0
fenliu-1.1.1
zhongli-2026.6.4
fenliu-1.1.0
zhongli-2026.5.26
zhongli-2026.5.23
fenliu-1.0.2
fenliu-1.0.1
zhongli-2026.5.21
zhongli-2026.5.18
fenliu-1.0.0
zhongli-2026.5.16
zhongli-2026.5.1
fenliu-0.13.1
zhongli-2026.4.22
fenliu-0.13.0
fenliu-0.12.1
fenliu-0.12.0
zhongli-2026.4.5
zhongli-2026.4.3
fenliu-0.11.0
fenliu-0.10.1
fenliu-0.10.0
zhongli-2026.3.25.1
2026.3.25
zhongli-2026.3.25
fenliu-0.9.0
zhongli-2026.3.19
fenliu-0.8.0
fenliu-0.7.10
fenliu-0.7.9
fenliu-0.7.8
fenliu-0.7.7
fenliu-0.7.6
fenliu-0.7.5
fenliu-0.7.4
zhongli-2026.3.17
fenliu-0.7.3
fenliu-0.7.2
zhongli-2026.3.15
fenliu-0.7.1
fenliu-0.7.0
fenliu-0.6.5
fenliu-0.6.4
zhongli-2026.3.12
fenliu-0.6.3
fenliu-0.6.2
fenliu-0.6.1
fenliu-0.6.0
fenliu-0.5.3
fenliu-0.5.2
fenliu-0.5.1
fenliu-0.5.0
fenliu-0.4.2
fenliu-0.4.1
zhongli-2026.3.4
fenliu-0.4.0
zhongli-2026.3.3
fenliu-0.3.0
fenliu-0.2.3
fenliu-0.2.2
fenliu-0.2.1
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
marvin8/dujiangyan#46
No description provided.