Jian Qiu 92193c8142 fix(appsrv): do not honor CORS credentials for wildcard origins (#25516) ...

With cors_hosts unset (the default), the CORS middleware allowed all
origins and echoed the request origin together with
Access-Control-Allow-Credentials, so any website could make
authenticated cross-origin requests against the API with the user's
cookies.

Credentials are now only honored for explicitly listed origins:
with an empty or wildcard origin allowlist the middleware responds
with Access-Control-Allow-Origin: * and no credentials header.

Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
Co-authored-by: Claude <noreply@anthropic.com>

2026-09-03 23:53:19 +08:00

..

dispatcher

fix: endpoint mode slave (#24023)

2026-01-06 18:05:27 +08:00

appparams.go

fix(common): service exception

2023-01-14 10:22:54 +08:00

appsrv_test.go

fix: use goid to identify differnt goroutine (#22740)

2025-06-19 14:50:47 +08:00

appsrv.go

fix(common): skip octet-stream warnning (#24068)

2026-01-13 18:20:35 +08:00

context.go

fix: remove mutual dependency of cloudmux on onecloud (#15621)

2022-12-27 01:21:26 +08:00

cors_test.go

fix(appsrv): do not honor CORS credentials for wildcard origins (#25516)

2026-09-03 23:53:19 +08:00

cors.go

fix(appsrv): do not honor CORS credentials for wildcard origins (#25516)

2026-09-03 23:53:19 +08:00

doc.go

update copyright headers of all source

2019-03-29 14:47:48 +08:00

fetch.go

goimports: first run

2019-10-28 06:22:17 +00:00

handlerinfo.go

fix: handler support worker manager callback (#22404)

2025-04-13 15:43:46 +08:00

handlers.go

fix: upgrade go 1.24 (#23242)

2025-09-05 18:26:42 +08:00

hashedworkermanager.go

feature: hashed worker manager (#21886)

2024-12-23 22:05:24 +08:00

process.go

fix: upgrade go 1.24 (#23242)

2025-09-05 18:26:42 +08:00

radix_test.go

test(radix_test.go): refactor TestRadixNode func make it more tidy (#14885)

2022-09-01 20:32:34 +08:00

radix.go

update copyright headers of all source

2019-03-29 14:47:48 +08:00

response.go

fix(mcp-server): support forwarding mcp-server request (#25191)

2026-07-21 13:27:43 +08:00

ring_test.go

appsrv: rework TestRing

2020-06-17 10:52:14 +08:00

ring.go

fix: trigger project sync by informer (#19836)

2024-04-02 00:23:44 +08:00

send.go

fix(apigateway): stream download content-type (#24508)

2026-03-20 13:41:40 +08:00

stages.go

update copyright headers of all source

2019-03-29 14:47:48 +08:00

stats.go

fix: upgrade go 1.24 (#23242)

2025-09-05 18:26:42 +08:00

whitelist_filter.go

fix: protect appsrv default handlers (#22341)

2025-03-26 17:51:54 +08:00

workers_test.go

fix(common): dump task info when stucking

2021-04-26 10:45:38 +08:00

workers_watchdog.go

fix: hide worker manager watchdog log

2019-12-25 18:26:53 +08:00

workers.go

fix: upgrade go 1.24 (#23242)

2025-09-05 18:26:42 +08:00