19 lines
1.2 KiB
Markdown
19 lines
1.2 KiB
Markdown
|
# Implementation: fix-dashboard-cors-origin
|
||
|
|
|
||
|
|
## Bug
|
||
|
|
Dashboard's `app.py` set `Access-Control-Allow-Origin: *` (wildcard CORS) on all responses via `CORS_HEADERS`. Since the dashboard is a local single-origin app, this wildcard CORS header is unnecessary and poses a security risk — any malicious webpage on the machine could make requests to the dashboard API.
|
||
|
|
|
||
|
|
## Fix
|
||
|
|
1. Removed `CORS_HEADERS` dictionary (which contained `Access-Control-Allow-Origin: *` and `Access-Control-Allow-Methods`)
|
||
|
|
2. Added `SECURITY_HEADERS` with `X-Content-Type-Options: nosniff` and `X-Frame-Options: DENY`
|
||
|
|
3. Updated `_send_json()`, `_send_error()`, and `do_OPTIONS()` to use `SECURITY_HEADERS` instead of `CORS_HEADERS`
|
||
|
|
4. `do_OPTIONS()` no longer returns `Access-Control-Allow-*` headers — it simply returns 204 No Content
|
||
|
|
|
||
|
|
## Files Changed
|
||
|
|
- `automaton/dashboard/ui/app.py`: Replaced `CORS_HEADERS` with `SECURITY_HEADERS`, updated all response methods
|
||
|
|
- `tests/test_app.py`: Updated CORS-related tests to assert NO `Access-Control-Allow-Origin` header is present, and that security headers are sent
|
||
|
|
|
||
|
|
## Tests
|
||
|
|
- `test_app.py` tests updated to verify security headers (`X-Content-Type-Options`, `X-Frame-Options`) and absence of CORS headers
|
||
|
|
- All 249 tests pass
|