mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-21 22:52:19 +03:00
f1b4a3d93e
The /v1* surface echoes an arbitrary Origin so token-authenticated browser / Electron clients can read the response (#5242) — safe only because Authorization / x-api-key are never auto-attached. On a keyless install /v1 is served anonymously, so a credential-less cross-origin page was echoed its own Origin and could drive the gateway (GHSA-7px7). The echo now requires the request to actually carry a credential (Authorization / x-api-key / x-goog-api-key or the auth_token cookie), or be a CORS preflight; truly anonymous cross-origin requests no longer get it. #5242 token and dashboard-session clients are unaffected. Reported by @Upshivam786 via GHSA-7px7-29v2-m97p.