fix(api): drop permissive CORS allowed_origin_fn (origin reflection) #156

Merged

David merged 2 commits from fix/BUNYIP-124-cors-origin-reflection into main

2026-06-17 12:44:56 +02:00

David commented

2026-06-17 03:24:35 +02:00

Owner

The actix Cors builder registered an allowed_origin_fn that returned true for any http://localhost* host (a starts_with prefix match, so attacker-controlled http://localhost.attacker.com also matched) and for any origin ending in .{BUNYIP_WEB_ORIGIN host} (a bare ends_with, so any *.{apex} subdomain matched). actix evaluates this closure in addition to the explicit .allowed_origin() entries, so the permissive closure overrode the tight CORS_ORIGIN allow-list. Combined with .supports_credentials(), an allowed Cookie request header, and .expose_headers(SET_COOKIE), this reflected credentialed CORS to untrusted origins.

Remove the allowed_origin_fn (and the now-unused cors_domain derivation) so only the explicit, comma-separated CORS_ORIGIN entries are echoed back with credentials and everything else gets no Access-Control-Allow-Origin, matching the CORS policy (no wildcards, explicit list). Local dev already enumerates http://localhost:4400 in CORS_ORIGIN, so dev is unaffected.

#BUNYIP-124

The actix Cors builder registered an `allowed_origin_fn` that returned true for any `http://localhost*` host (a `starts_with` prefix match, so attacker-controlled `http://localhost.attacker.com` also matched) and for any origin ending in `.{BUNYIP_WEB_ORIGIN host}` (a bare `ends_with`, so any `*.{apex}` subdomain matched). actix evaluates this closure in addition to the explicit `.allowed_origin()` entries, so the permissive closure overrode the tight CORS_ORIGIN allow-list. Combined with `.supports_credentials()`, an allowed `Cookie` request header, and `.expose_headers(SET_COOKIE)`, this reflected credentialed CORS to untrusted origins. Remove the `allowed_origin_fn` (and the now-unused `cors_domain` derivation) so only the explicit, comma-separated CORS_ORIGIN entries are echoed back with credentials and everything else gets no Access-Control-Allow-Origin, matching the CORS policy (no wildcards, explicit list). Local dev already enumerates `http://localhost:4400` in CORS_ORIGIN, so dev is unaffected. #BUNYIP-124

David added 1 commit

2026-06-17 03:24:35 +02:00

fix(api): drop permissive CORS allowed_origin_fn (origin reflection)

Check / fmt / clippy / build / test (pull_request) Successful in 1m36s

Details

ab3c397a64

The actix Cors builder registered an `allowed_origin_fn` that returned true for any `http://localhost*` host (a `starts_with` prefix match, so attacker-controlled `http://localhost.attacker.com` also matched) and for any origin ending in `.{BUNYIP_WEB_ORIGIN host}` (a bare `ends_with`, so any `*.{apex}` subdomain matched). actix evaluates this closure in addition to the explicit `.allowed_origin()` entries, so the permissive closure overrode the tight CORS_ORIGIN allow-list. Combined with `.supports_credentials()`, an allowed `Cookie` request header, and `.expose_headers(SET_COOKIE)`, this reflected credentialed CORS to untrusted origins.

Remove the `allowed_origin_fn` (and the now-unused `cors_domain` derivation) so only the explicit, comma-separated CORS_ORIGIN entries are echoed back with credentials and everything else gets no Access-Control-Allow-Origin, matching the CORS policy (no wildcards, explicit list). Local dev already enumerates `http://localhost:4400` in CORS_ORIGIN, so dev is unaffected.

#BUNYIP-124

David added 1 commit

2026-06-17 12:44:50 +02:00

Merge branch 'main' into fix/BUNYIP-124-cors-origin-reflection

Check / fmt / clippy / build / test (pull_request) Failing after 6s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

0755bec87d