Default CORS origin to PUBLIC_APP_URL instead of reflecting any origin with credentials #29

New issue

Open

opened 2026-07-17 03:07:24 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-07-17 03:07:24 +00:00

Contributor

backend/src/app.js:73 passes origin: true, credentials: true whenever CORS_ORIGIN=*, which is the default in config.js:7, .env.example:3, and docker-compose.full.yml:17. Reflected-origin + credentials is unsafe by construction; the current sameSite: 'lax' session cookie is the only thing keeping it theoretical.

Fix: when auth is enabled, use PUBLIC_APP_URL (already configured) as the default allowed origin and reject *; keep permissive CORS only for AUTH_MODE=disabled localhost development. Update .env.example and compose defaults to match.

Acceptance criteria

Authenticated deployments no longer reflect arbitrary origins
Default configuration works without setting CORS_ORIGIN manually
.env.example / compose updated

Relations: relates to #8

(Audit finding F-08, 2026-07-16 — Severity: Medium, Confidence: High)

`backend/src/app.js:73` passes `origin: true, credentials: true` whenever `CORS_ORIGIN=*`, which is the default in `config.js:7`, `.env.example:3`, and `docker-compose.full.yml:17`. Reflected-origin + credentials is unsafe by construction; the current `sameSite: 'lax'` session cookie is the only thing keeping it theoretical. Fix: when auth is enabled, use `PUBLIC_APP_URL` (already configured) as the default allowed origin and reject `*`; keep permissive CORS only for `AUTH_MODE=disabled` localhost development. Update `.env.example` and compose defaults to match. **Acceptance criteria** - [ ] Authenticated deployments no longer reflect arbitrary origins - [ ] Default configuration works without setting CORS_ORIGIN manually - [ ] .env.example / compose updated **Relations:** relates to #8 *(Audit finding F-08, 2026-07-16 — Severity: Medium, Confidence: High)*

claude-bot added this to the v1.1.0 - Test & Ops Hardening milestone

2026-07-17 03:10:45 +00:00

claude-bot added the

ops

security

labels

2026-07-17 03:11:44 +00:00

claude-bot referenced this issue

2026-07-17 15:21:14 +00:00

Configure Authentik env vars on deployment host and verify OIDC callback behind Caddy #8