From f4d544d09e5583cc7e5a453ece2470b27156f9b2 Mon Sep 17 00:00:00 2001 From: Robby Manihani Date: Sun, 26 Apr 2026 17:08:38 -0700 Subject: [PATCH] fix(server): replace CORS wildcard fallback with closed localhost list (#283) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit server/app.py defaulted to allow_origins=["*"] combined with allow_credentials=True when cors_origins was not passed. That combination is invalid per the CORS spec — browsers reject it — and when used loosely it signals that any cross-origin request with credentials is allowed, exposing session cookies and auth headers. The reference config at configs/openjarvis/config.toml binds to 0.0.0.0 without setting cors_origins, so this fallback fired in every default deployment. Default to a closed list (Vite dev origin + Tauri webview) instead of the wildcard. Users who actually need a custom origin already pass it via cors_origins. Closes #222 --- src/openjarvis/server/app.py | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/openjarvis/server/app.py b/src/openjarvis/server/app.py index 423cdbfd..a2a738ac 100644 --- a/src/openjarvis/server/app.py +++ b/src/openjarvis/server/app.py @@ -181,7 +181,15 @@ def create_app( from fastapi.middleware.cors import CORSMiddleware - _origins = cors_origins if cors_origins is not None else ["*"] + _origins = ( + cors_origins + if cors_origins is not None + else [ + "http://localhost:5173", + "http://127.0.0.1:5173", + "tauri://localhost", + ] + ) app.add_middleware( CORSMiddleware, allow_origins=_origins,