Files
OmniRoute/tests/unit
Xiangzhe f1b4a3d93e fix(security): require a credential before echoing the CORS Origin on /v1
The /v1* surface echoes an arbitrary Origin so token-authenticated browser /
Electron clients can read the response (#5242) — safe only because
Authorization / x-api-key are never auto-attached. On a keyless install /v1 is
served anonymously, so a credential-less cross-origin page was echoed its own
Origin and could drive the gateway (GHSA-7px7). The echo now requires the request
to actually carry a credential (Authorization / x-api-key / x-goog-api-key or the
auth_token cookie), or be a CORS preflight; truly anonymous cross-origin requests
no longer get it. #5242 token and dashboard-session clients are unaffected.

Reported by @Upshivam786 via GHSA-7px7-29v2-m97p.
2026-08-21 14:49:32 -03:00
..
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00