Skip to content

security(main.ts): CORS allows origin '*' together with credentials:true #660

Open
Open
security(main.ts): CORS allows origin '*' together with credentials:true#660

Description

@phertyameen
phertyameen
opened on Aug 23, 2026

Summary

backend/src/main.ts bootstraps CORS as:

app.enableCors({
  origin: '*',
  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  credentials: true,
});

Per the Fetch/CORS spec, Access-Control-Allow-Origin: * cannot be combined with credentialed requests - browsers reject such responses. Depending on how the underlying layer behaves, this means either (a) credentialed browser clients are broken, or (b) origins are effectively reflected, making every site trusted to send cookie/Authorization-bearing requests. Both outcomes are wrong.

Proposal

  1. Move the allowlist to configuration: read CORS_ORIGINS (comma-separated) from env via the existing ConfigModule/app.config.ts.
  2. Pass origin: <allowlist> and keep credentials: true only when the allowlist is non-wildcard.
  3. Document the variable in docs/ENVIRONMENT.md (which already catalogs backend env vars).

Acceptance criteria

  • Wildcard + credentials combo removed from the production path.
  • Local development still works with a documented dev default (e.g. http://localhost:5173).
  • Env var documented alongside the rest of the config surface.

Activity

  1. rupesh-kumar-sah commented on Sep 14, 2026

    @rupesh-kumar-sah
    rupesh-kumar-sah
    on Sep 14, 2026

    Hello! I'd like to work on this issue.

    I would like to resolve this issue. Here is my proposed execution plan:

    • Implementation: Deliver a clean, modular solution for security(main.ts): CORS allows origin '*' together with credentials:true strictly following MindBlockLabs/mindBlock_app conventions.
    • Testing: Cover changes with automated tests ensuring CI passes smoothly.

    Looking forward to contributing—please feel free to assign!

  2. guptakumarranjeet150 commented on Oct 3, 2026

    @guptakumarranjeet150
    guptakumarranjeet150
    on Oct 3, 2026

    Greetings,

    I would like to work on this issue.

    Plan:

    1. Audit storage layout and state invariants ensuring strict auth guards.
    2. Implement deterministic state transitions with safe checked arithmetic.
    3. Add hermetic unit and regression tests covering authorized, unauthorized, and boundary edge cases.
    4. Profile instruction and CPU/gas limits under Soroban host environment.

    Ready to implement immediately upon assignment. Please feel free to assign!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions