Add CORS origin validation to reject requests from unknown domains #738

New issue

Open

opened 2026-04-11 14:35:22 -04:00 by pook · 0 comments

pook commented

2026-04-11 14:35:22 -04:00

Owner

Configure cors middleware with explicit origin allowlist (not wildcard)
Read allowed origins from CORS_ORIGINS env var (comma-separated)
Default to 'http://localhost:3000,http://localhost:5173' in development
Return 403 Forbidden for requests from non-allowlisted origins
Include origin in error response for debugging
Add test: request from unknown origin receives CORS rejection
Add test: request from allowed origin succeeds
Same pattern as contractpilot PR #411

Generated by CEO Planner (priority: 2)

Add strict CORS origin validation to the Express server. Only allow requests from configured origins. This is a security fix — currently unknown origins may be able to make cross-origin requests to the API. Acceptance criteria: - Configure cors middleware with explicit origin allowlist (not wildcard) - Read allowed origins from CORS_ORIGINS env var (comma-separated) - Default to 'http://localhost:3000,http://localhost:5173' in development - Return 403 Forbidden for requests from non-allowlisted origins - Include origin in error response for debugging - Add test: request from unknown origin receives CORS rejection - Add test: request from allowed origin succeeds - Same pattern as contractpilot PR #411 --- *Generated by CEO Planner (priority: 2)*

pook added the

agent-task

label

2026-04-11 14:35:22 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#738

No description provided.

Rows
Columns