From 7bf3c76a1b0e2da598ffa656e4029b1d144c4818 Mon Sep 17 00:00:00 2001 From: Jeroen Schweitzer Date: Sat, 3 Jan 2026 23:09:47 +0100 Subject: [PATCH] fix(cors): use explicit origins instead of wildcard MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When allow_credentials=True, browsers reject wildcard (*) origins. Added specific allowed origins for Tatlock domains. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 --- CHANGELOG.md | 8 ++++++++ pyproject.toml | 2 +- src/shared/config.py | 11 +++++++++-- 3 files changed, 18 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 52742f8..3a82d1b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [1.9.1] - 2026-01-03 + +### Fixed + +- CORS configuration now uses explicit origins instead of `"*"` + - When `allow_credentials=True`, wildcard origins are rejected by browsers + - Added `home.schweitz.net`, `tatlock.schweitz.net`, and localhost origins + ## [1.9.0] - 2026-01-03 ### Added diff --git a/pyproject.toml b/pyproject.toml index 76d27e1..707d49f 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "core-api" -version = "1.9.0" +version = "1.9.1" description = "Core Code API - Infrastructure management and tools API" readme = "README.md" requires-python = ">=3.12" diff --git a/src/shared/config.py b/src/shared/config.py index f01c159..ee9009d 100644 --- a/src/shared/config.py +++ b/src/shared/config.py @@ -36,8 +36,15 @@ class Settings(BaseSettings): host: str = "0.0.0.0" port: int = 8083 - # CORS - cors_origins: list[str] = ["*"] + # CORS - Note: When cors_credentials is True, cannot use "*" for origins + # Set CORS_ORIGINS env var to override (comma-separated list) + cors_origins: list[str] = [ + "https://home.schweitz.net", + "https://tatlock.schweitz.net", + "http://localhost:8080", + "http://localhost:3000", + "http://127.0.0.1:8080", + ] cors_credentials: bool = True cors_methods: list[str] = ["*"] cors_headers: list[str] = ["*"]