CORS wildcard is applied at the router root, covering the cookie-authenticated routes #98
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
From the audit against the canonical
REPO_POLICIES.md, verified againstmainat61f42e6.The policy states:
> Authenticated endpoints must restrict
Access-Control-Allow-Originto an explicit allowlist of known origins. Wildcard (*) is acceptable only for public, unauthenticated read-only APIs.internal/middleware/middleware.go:112-121returnscors.Handler(cors.Options{AllowedOrigins: []string{"*"}, ...}), andinternal/server/routes.go:28applies it withs.router.Use(s.mw.CORS())at the router root. So the wildcard covers/and/generate(session-cookie authenticated,internal/handlers/auth.go:25,80) and/metrics(basic-auth'd,routes.go:65) alongside the genuinely public/v1/image/*routes.Stated honestly — this is a policy divergence, not a demonstrated vulnerability. Exploitability is limited because
AllowCredentials: false(middleware.go:118) andAllowedMethodsis onlyGET, HEAD, OPTIONS(middleware.go:115), so a compliant browser will not attach cookies to a cross-origin request nor allow a cross-origin read of an authenticated response. The policy's wording is nonetheless categorical about authenticated endpoints, and the current arrangement means the safety depends entirely on two other options staying as they are — a future change toAllowCredentialsorAllowedMethods, made for the public routes, would silently widen exposure on the authenticated ones.That coupling is the real defect: the security of the authenticated routes should not be an emergent property of settings chosen for the public ones.
Definition of done
/v1/image/*,/v1/e/*), rather than applied at the router root — or the authenticated routes get an explicit origin allowlist sourced from config.Access-Control-Allow-Originheader differs between a public route and an authenticated one, so the separation cannot silently regress./metricsis decided deliberately: it is not a browser-facing resource and arguably needs no CORS headers at all.make checkgreen.Coordination
This overlaps #61, which adds the
access_control_allow_originconfig key thatREADME.mddocuments but the code does not implement. Do #61 first, then scope the resulting configurable origin correctly here — otherwise the two changes will collide ininternal/middleware/middleware.go. Alternatively, fold this into #61's PR and close this as part of it; say which in the PR.