Skip to content

Restrict production CORS origins#4199

Open
laughlife wants to merge 1 commit into
SecureBananaLabs:mainfrom
laughlife:fix/production-cors-origin-allowlist
Open

Restrict production CORS origins#4199
laughlife wants to merge 1 commit into
SecureBananaLabs:mainfrom
laughlife:fix/production-cors-origin-allowlist

Conversation

@laughlife

Copy link
Copy Markdown

Summary

  • restrict production CORS responses to origins listed in CORS_ALLOWED_ORIGINS
  • keep development permissive when no allowlist is configured
  • add API regression coverage for denied and allowed production origins
  • update the API test script to run *.test.js files explicitly

Tests

  • npm test

Fixes #4188
/claim #743

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Production API should restrict CORS origins

1 participant