2b94895 fix(security): cors wildcard with credentials
📊 Changes
1 file changed (+1 additions, -3 deletions)
View changed files
📝flowsint-api/app/main.py (+1 -3)
📄 Description
Summary
Security: CORS Wildcard with Credentials
Problem
Severity: High | File: flowsint-api/app/main.py:L30
The FastAPI application allows all origins with allow_origins=['*'] while also setting allow_credentials=True. This is a security misconfiguration as browsers will block requests with credentials when the origin is wildcard.
Solution
Replace wildcard '*' with specific allowed origins. If multiple origins are needed, use a list of explicit URLs instead of allowing all origins with credentials.
Changes
flowsint-api/app/main.py (modified)
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/reconurge/flowsint/pull/146
**Author:** [@tomaioo](https://github.com/tomaioo)
**Created:** 5/15/2026
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `fix/security/cors-wildcard-with-credentials`
---
### 📝 Commits (1)
- [`2b94895`](https://github.com/reconurge/flowsint/commit/2b94895793f1d12ad9fa0a9b1d82b543d753b5a9) fix(security): cors wildcard with credentials
### 📊 Changes
**1 file changed** (+1 additions, -3 deletions)
<details>
<summary>View changed files</summary>
📝 `flowsint-api/app/main.py` (+1 -3)
</details>
### 📄 Description
## Summary
Security: CORS Wildcard with Credentials
## Problem
**Severity**: `High` | **File**: `flowsint-api/app/main.py:L30`
The FastAPI application allows all origins with `allow_origins=['*']` while also setting `allow_credentials=True`. This is a security misconfiguration as browsers will block requests with credentials when the origin is wildcard.
## Solution
Replace wildcard '*' with specific allowed origins. If multiple origins are needed, use a list of explicit URLs instead of allowing all origins with credentials.
## Changes
- `flowsint-api/app/main.py` (modified)
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/reconurge/flowsint/pull/146
Author: @tomaioo
Created: 5/15/2026
Status: ❌ Closed
Base:
main← Head:fix/security/cors-wildcard-with-credentials📝 Commits (1)
2b94895fix(security): cors wildcard with credentials📊 Changes
1 file changed (+1 additions, -3 deletions)
View changed files
📝
flowsint-api/app/main.py(+1 -3)📄 Description
Summary
Security: CORS Wildcard with Credentials
Problem
Severity:
High| File:flowsint-api/app/main.py:L30The FastAPI application allows all origins with
allow_origins=['*']while also settingallow_credentials=True. This is a security misconfiguration as browsers will block requests with credentials when the origin is wildcard.Solution
Replace wildcard '*' with specific allowed origins. If multiple origins are needed, use a list of explicit URLs instead of allowing all origins with credentials.
Changes
flowsint-api/app/main.py(modified)🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.