Jian Qiu c557a8b230 fix(appsrv): do not honor CORS credentials for wildcard origins (#25501) ...

With cors_hosts unset (the default), the CORS middleware allowed all
origins and echoed the request origin together with
Access-Control-Allow-Credentials, so any website could make
authenticated cross-origin requests against the API with the user's
cookies.

Credentials are now only honored for explicitly listed origins:
with an empty or wildcard origin allowlist the middleware responds
with Access-Control-Allow-Origin: * and no credentials header.

Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
Co-authored-by: Claude <noreply@anthropic.com>

2026-09-03 23:53:36 +08:00

..

agent

fix(region,baremetal): ipv6 baremetal register support (#23419)

2025-09-29 15:22:14 +08:00

app

fix: endpoint mode slave (#24016)

2026-01-06 18:05:41 +08:00

cmdline

fix: unhandled errors (#25383)

2026-08-20 17:30:29 +08:00

consts

fix: task clean job in batch limit (#22238)

2025-03-07 01:50:33 +08:00

cronman

fix(common): context with time (#22708)

2025-06-16 17:15:59 +08:00

db

fix(cloudcommon): fix err shadowing in GetPropertyDistinctField (#25472)

2026-09-02 15:58:21 +08:00

elect

feat(vendor): update etcd package for master

2022-03-08 10:52:23 +08:00

etcd

fix: upgrade go 1.24 (#23241)

2025-09-05 18:26:33 +08:00

informer

fix(common): context with time (#22708)

2025-06-16 17:15:59 +08:00

notifyclient

fix(region,host): rbd snapshot get actual size (#24242)

2026-02-07 17:31:23 +08:00

options

fix(appsrv): do not honor CORS credentials for wildcard origins (#25501)

2026-09-03 23:53:36 +08:00

pending_delete

fix: refine service-config change detection

2020-03-30 16:03:21 +08:00

policy

fix: mask tokens and passwords in logs (#25489)

2026-09-03 19:20:25 +08:00

service

- add command executor

2019-12-04 20:49:39 +08:00

syncman

fix(common): context with time (#22708)

2025-06-16 17:15:59 +08:00

tsdb

fix(lbagent,monitor): use victoria-metrics for telegraf and fix influxql translation (#24733)

2026-04-27 16:42:08 +08:00

types

feat(baremetal): support IPMI RMCP+ cipher suite probe and persist (#25239)

2026-07-28 10:27:20 +08:00

userdata

fix: support user data scripts (#17938)

2023-09-06 17:16:46 +08:00

validators

chore: slice loop replace (#20204)

2024-05-07 18:19:15 +08:00

workmanager

fix: image cache use specific workers (#22046)

2025-02-05 11:33:28 +08:00

database.go

fix: region-dns not support dameng dialect (#23809)

2025-11-21 09:55:06 +08:00

doc.go

update copyright headers of all source

2019-03-29 14:47:48 +08:00