CORS allows wildcard origin (*) - placeholder left from template #23

New Issue

clawbot · 2026-03-02T01:29:07+01:00

clawbot commented

2026-03-02 01:29:07 +01:00

Bug

The CORS middleware in internal/middleware/middleware.go allows all origins with a wildcard:

func (s *Middleware) CORS() func(http.Handler) http.Handler {
    return cors.Handler(cors.Options{
        // CHANGEME! these are defaults, change them to suit your needs or
        // read from environment/viper.
        AllowedOrigins: []string{"*"},

The CHANGEME! comment indicates this is a placeholder default that was never updated.

While AllowCredentials: false mitigates the worst cross-origin cookie attacks, wildcard CORS still means any site can read responses from webhooker's public endpoints (healthcheck, webhook receiver responses).

For a webhook proxy that handles sensitive payload data, CORS should either:

Be restricted to specific origins (the management UI's domain)
Not include any CORS headers at all (the default for browsers is to block cross-origin requests)

Fix

Remove the wildcard CORS or make it configurable:

AllowedOrigins: []string{},  // No cross-origin access by default

Or read from config:

AllowedOrigins: s.params.Config.CORSOrigins,

Category

Should-fix for security.

## Bug The CORS middleware in `internal/middleware/middleware.go` allows all origins with a wildcard: ```go func (s *Middleware) CORS() func(http.Handler) http.Handler { return cors.Handler(cors.Options{ // CHANGEME! these are defaults, change them to suit your needs or // read from environment/viper. AllowedOrigins: []string{"*"}, ``` The `CHANGEME!` comment indicates this is a placeholder default that was never updated. While `AllowCredentials: false` mitigates the worst cross-origin cookie attacks, wildcard CORS still means any site can read responses from webhooker's public endpoints (healthcheck, webhook receiver responses). For a webhook proxy that handles sensitive payload data, CORS should either: - Be restricted to specific origins (the management UI's domain) - Not include any CORS headers at all (the default for browsers is to block cross-origin requests) ## Fix Remove the wildcard CORS or make it configurable: ```go AllowedOrigins: []string{}, // No cross-origin access by default ``` Or read from config: ```go AllowedOrigins: s.params.Config.CORSOrigins, ``` ## Category Should-fix for security.

clawbot added the

bot

label 2026-03-02 01:29:07 +01:00

clawbot referenced this issue

2026-03-02 01:31:01 +01:00

1.0/mvp #15

clawbot referenced this issue from a commit

2026-03-02 01:42:00 +01:00

fix: restrict CORS to same-origin (closes #23)

clawbot referenced this issue

2026-03-02 01:42:14 +01:00

feat: webhooker 1.0 MVP — entity rename, core engine, delivery, management UI #16