[PR #146] Security: CORS Wildcard with Credentials #1850

New Issue

GiteaMirror · 2026-05-20T14:26:55-05:00

GiteaMirror commented

2026-05-20 14:26:55 -05:00

📋 Pull Request Information

Original PR: https://github.com/reconurge/flowsint/pull/146
Author: @tomaioo
Created: 5/15/2026
Status: 🔄 Open

Base: main ← Head: fix/security/cors-wildcard-with-credentials

📝 Commits (1)

2b94895 fix(security): cors wildcard with credentials

📊 Changes

1 file changed (+1 additions, -3 deletions)

View changed files

📝 flowsint-api/app/main.py (+1 -3)

📄 Description

Summary

Security: CORS Wildcard with Credentials

Problem

Severity: High | File: flowsint-api/app/main.py:L30

The FastAPI application allows all origins with allow_origins=['*'] while also setting allow_credentials=True. This is a security misconfiguration as browsers will block requests with credentials when the origin is wildcard.

Solution

Replace wildcard '*' with specific allowed origins. If multiple origins are needed, use a list of explicit URLs instead of allowing all origins with credentials.

Changes

flowsint-api/app/main.py (modified)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/reconurge/flowsint/pull/146 **Author:** [@tomaioo](https://github.com/tomaioo) **Created:** 5/15/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/security/cors-wildcard-with-credentials` --- ### 📝 Commits (1) - [`2b94895`](https://github.com/reconurge/flowsint/commit/2b94895793f1d12ad9fa0a9b1d82b543d753b5a9) fix(security): cors wildcard with credentials ### 📊 Changes **1 file changed** (+1 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `flowsint-api/app/main.py` (+1 -3) </details> ### 📄 Description ## Summary Security: CORS Wildcard with Credentials ## Problem **Severity**: `High` | **File**: `flowsint-api/app/main.py:L30` The FastAPI application allows all origins with `allow_origins=['*']` while also setting `allow_credentials=True`. This is a security misconfiguration as browsers will block requests with credentials when the origin is wildcard. ## Solution Replace wildcard '*' with specific allowed origins. If multiple origins are needed, use a list of explicit URLs instead of allowing all origins with credentials. ## Changes - `flowsint-api/app/main.py` (modified) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-05-20 14:26:55 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/flowsint#1850