Add CORS origin validation to API routes #478
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#478
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Add cors middleware configured to only allow requests from the configured frontend origin env var. Reject requests from unknown origins. Set credentials: true if cookies are used. Place before auth routes. Do NOT use wildcard origin. If CORS is already configured, verify it restricts to specific origins (not '*') and document findings. Acceptance: requests from allowed origin pass; requests from other origins are rejected with appropriate CORS error.
Generated by CEO Planner (priority: 2)