Skip to content

🔒 Restrict permissive CORS policy#12

Merged
davidraehles merged 3 commits intomainfrom
security/fix-permissive-cors-8453454130598439823
Feb 18, 2026
Merged

🔒 Restrict permissive CORS policy#12
davidraehles merged 3 commits intomainfrom
security/fix-permissive-cors-8453454130598439823

Conversation

@davidraehles
Copy link
Copy Markdown
Collaborator

🎯 What: Fixed a permissive CORS policy in backend/src/server.ts that defaulted to origin: *.

⚠️ Risk: A permissive CORS policy allows any website to make requests to the API. This could potentially be exploited by malicious sites to perform unauthorized actions or exfiltrate data if other security controls are weak.

🛡️ Solution:

  • Updated backend/src/server.ts to use a whitelist of allowed origins.
  • Origins are read from the ALLOWED_ORIGINS environment variable.
  • Robust parsing ensures that whitespace around commas is correctly handled.
  • Sensible default (http://localhost:5173) is provided for local development.

PR created automatically by Jules for task 8453454130598439823 started by @davidraehles

- Restricted CORS origins using ALLOWED_ORIGINS env var
- Added robust whitespace handling for comma-separated origins
- Defaulted to http://localhost:5173 for local development

Co-authored-by: davidraehles <6085055+davidraehles@users.noreply.github.com>
Copilot AI review requested due to automatic review settings February 18, 2026 19:33
@google-labs-jules
Copy link
Copy Markdown
Contributor

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request enhances security by replacing a permissive CORS policy that allowed requests from any origin (origin: *) with a whitelist-based approach. The backend now only accepts requests from origins specified in the ALLOWED_ORIGINS environment variable, with a sensible default for local development.

Changes:

  • Updated CORS middleware configuration to use an environment-based origin whitelist
  • Added robust parsing of comma-separated origins from the ALLOWED_ORIGINS environment variable
  • Provided a safe default (http://localhost:5173) for local development when the variable is not set

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
backend/src/server.ts Modified CORS configuration from permissive origin: * to whitelist-based approach using ALLOWED_ORIGINS environment variable
.jules/sentinel.md Added documentation about the CORS policy fix and key learnings for future reference

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread backend/src/server.ts
: ['http://localhost:5173'];

app.use(cors({
origin: allowedOrigins,
Copy link

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The CORS configuration is missing the credentials option. Since the application uses JWT tokens sent via Authorization headers and may use cookies in the future, you should add credentials: true to allow browsers to include credentials in cross-origin requests. Without this, authenticated requests from the frontend may fail when deployed to different domains.

Suggested change
origin: allowedOrigins,
origin: allowedOrigins,
credentials: true,

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added credentials: true to the CORS configuration to support cookie-based authentication.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done. Added credentials: true to the CORS configuration.

Comment thread backend/src/server.ts Outdated
// Middleware
app.use(cors());
const allowedOrigins = process.env.ALLOWED_ORIGINS
? process.env.ALLOWED_ORIGINS.split(',').map(origin => origin.trim())
Copy link

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The environment variable parsing does not handle edge cases properly. If ALLOWED_ORIGINS contains empty strings after splitting (e.g., "http://localhost:5173,"), the resulting array will include empty strings which are invalid origins. Consider filtering out empty strings after trimming to avoid potential security issues or runtime errors.

Suggested change
? process.env.ALLOWED_ORIGINS.split(',').map(origin => origin.trim())
? process.env.ALLOWED_ORIGINS
.split(',')
.map(origin => origin.trim())
.filter(origin => origin.length > 0)

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added .filter(origin => origin.length > 0) after the trim to prevent empty strings from being included as allowed origins.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done. Added .filter(Boolean) to remove any empty strings after trimming.

OpenCode and others added 2 commits February 18, 2026 21:18
- Added credentials: true to support cookie-based auth
- Added filtering to remove empty strings from allowedOrigins list

Co-authored-by: davidraehles <6085055+davidraehles@users.noreply.github.com>
@davidraehles davidraehles merged commit 18b5733 into main Feb 18, 2026
davidraehles added a commit that referenced this pull request Feb 18, 2026
…6-7-8-10-11-12-13-14

Merge PRs #1, #2, #3, #4, #5, #6, #7, #8, #10, #11, #12, #13, #14 into main
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants