mirror of
https://github.com/MervinPraison/PraisonAI.git
synced 2026-11-09 03:39:37 -10:00
dd41a3c426
* security: Fix CORS Configuration Vulnerabilities (CWE-942) - Replace wildcard origins - Replace allow_origins=['*'] with secure environment-based configurations - Update browser server to use BROWSER_CORS_ORIGINS env var with localhost defaults - Update jobs server to use JOBS_CORS_ORIGINS env var with localhost defaults - Update example API to use API_CORS_ORIGINS env var with localhost defaults - Remove wildcard defaults from ServerConfig, GatewayConfig, and AppConfig - Add secure localhost defaults to MCP server transport - Update tests and documentation to reflect secure defaults - Restrict CORS methods and headers to essential ones only Fixes #1321 - Addresses 3 instances of CWE-942 vulnerabilities 🤖 Generated with [Claude Code](https://claude.ai/code) Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com> * fix: Address 3 CORS bugs found in review - chrome-extension regex, http_stream headers, server.py methods/headers Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/b76a2075-da18-4ad5-82e8-79fc09457529 Co-authored-by: MervinPraison <[email protected]> * security: Fix remaining CORS vulnerabilities (CWE-942) - Add environment-based CORS defaults (empty for production) - Validate env vars to reject wildcard origins (*) - Add missing Idempotency-Key header to jobs CORS - Unify WebSocket and HTTP CORS origin validation - Make http_stream transport environment-aware Fixes all critical security issues identified by code reviewers: - Production no longer allows localhost by default - Environment variables cannot bypass security with * - WebSocket uses same origin validation as CORS middleware - Jobs API properly supports Idempotency-Key header 🤖 Generated with [Claude Code](https://claude.ai/code) Co-authored-by: Mervin Praison <[email protected]> --------- Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com> Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: MervinPraison <[email protected]> Co-authored-by: Mervin Praison <[email protected]>