* security: Fix CORS Configuration Vulnerabilities (CWE-942) - Replace wildcard origins
- Replace allow_origins=['*'] with secure environment-based configurations
- Update browser server to use BROWSER_CORS_ORIGINS env var with localhost defaults
- Update jobs server to use JOBS_CORS_ORIGINS env var with localhost defaults
- Update example API to use API_CORS_ORIGINS env var with localhost defaults
- Remove wildcard defaults from ServerConfig, GatewayConfig, and AppConfig
- Add secure localhost defaults to MCP server transport
- Update tests and documentation to reflect secure defaults
- Restrict CORS methods and headers to essential ones only
Fixes#1321 - Addresses 3 instances of CWE-942 vulnerabilities
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
* fix: Address 3 CORS bugs found in review - chrome-extension regex, http_stream headers, server.py methods/headers
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/b76a2075-da18-4ad5-82e8-79fc09457529
Co-authored-by: MervinPraison <[email protected]>
* security: Fix remaining CORS vulnerabilities (CWE-942)
- Add environment-based CORS defaults (empty for production)
- Validate env vars to reject wildcard origins (*)
- Add missing Idempotency-Key header to jobs CORS
- Unify WebSocket and HTTP CORS origin validation
- Make http_stream transport environment-aware
Fixes all critical security issues identified by code reviewers:
- Production no longer allows localhost by default
- Environment variables cannot bypass security with *
- WebSocket uses same origin validation as CORS middleware
- Jobs API properly supports Idempotency-Key header
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
- Multi-agent system with 6 specialized research agents
- Customizable parameters for company, geography, industry, and sections
- YAML configuration for easy setup and customization
- FastAPI integration with async job processing and REST API
- Professional report generation suitable for business decision-making
- Jupyter notebook with multiple implementation examples
- Complete documentation and usage guidelines
Addresses issue #18 - Secondary market research agent with customization
Co-authored-by: MervinPraison <[email protected]>
