In app/main.py the CORS setup has both of these:
allow_origin_regex=r"https://.*\.vercel\.app",
allow_credentials=True,
That regex matches every site hosted on vercel.app, and anyone can deploy one. I checked it against the app:
GET /health with Origin: https://evil-site.vercel.app
-> access-control-allow-origin: https://evil-site.vercel.app
-> access-control-allow-credentials: true
while https://example.com correctly gets no CORS header. So any site on vercel.app can make credentialed requests to the API from a visitor's browser.
There is no authentication yet, so the impact today is limited, but this will matter as soon as auth from the "Future Improvements" list gets added.
Suggested fix: list the real frontend origin(s) explicitly, ideally read from an environment variable, or narrow the regex to this project's own Vercel domain (for example https://rightsplit(-[a-z0-9-]+)?\.vercel\.app).
In
app/main.pythe CORS setup has both of these:That regex matches every site hosted on vercel.app, and anyone can deploy one. I checked it against the app:
while
https://example.comcorrectly gets no CORS header. So any site on vercel.app can make credentialed requests to the API from a visitor's browser.There is no authentication yet, so the impact today is limited, but this will matter as soon as auth from the "Future Improvements" list gets added.
Suggested fix: list the real frontend origin(s) explicitly, ideally read from an environment variable, or narrow the regex to this project's own Vercel domain (for example
https://rightsplit(-[a-z0-9-]+)?\.vercel\.app).