SECURITY: CORS allows all origins (*) — review for CSRF implications #40

New Issue

clawbot · 2026-02-16T06:56:34+01:00

clawbot commented

2026-02-16 06:56:34 +01:00

Severity: MEDIUM

File: `internal/middleware/middleware.go` lines ~120-130 (CORS method)

Description

cors.Handler(cors.Options{
    AllowedOrigins: []string{"*"},
    ...
    AllowCredentials: false,
})

While AllowCredentials: false prevents cookies from being sent with cross-origin requests (good), the wildcard CORS policy still allows any website to make API calls to the upaas instance. This means:

The JSON API endpoints (/apps/{id}/status, /apps/{id}/container-logs, etc.) are accessible from any origin
While they won't include session cookies, if there's ever an auth bypass or a non-cookie auth mechanism added, this becomes exploitable

For a single-user admin panel, a wildcard CORS policy is unnecessarily permissive.

Suggested Fix

Restrict CORS to same-origin only, or remove the CORS middleware entirely since this is a server-rendered app that doesn't need cross-origin API access:

AllowedOrigins: []string{}, // or remove CORS middleware entirely

## Severity: MEDIUM ## File: `internal/middleware/middleware.go` lines ~120-130 (CORS method) ## Description ```go cors.Handler(cors.Options{ AllowedOrigins: []string{"*"}, ... AllowCredentials: false, }) ``` While `AllowCredentials: false` prevents cookies from being sent with cross-origin requests (good), the wildcard CORS policy still allows any website to make API calls to the upaas instance. This means: - The JSON API endpoints (`/apps/{id}/status`, `/apps/{id}/container-logs`, etc.) are accessible from any origin - While they won't include session cookies, if there's ever an auth bypass or a non-cookie auth mechanism added, this becomes exploitable For a single-user admin panel, a wildcard CORS policy is unnecessarily permissive. ## Suggested Fix Restrict CORS to same-origin only, or remove the CORS middleware entirely since this is a server-rendered app that doesn't need cross-origin API access: ```go AllowedOrigins: []string{}, // or remove CORS middleware entirely ```

Sign in to join this conversation.