Skip to content

Security: CORS allows all origins with credentials; auth cookie missing Secure flag #11

Description

@pallyoung

Critical Security Issues

Found during review of feature/refactor-ts branch.

1. CORS allows all origins with credentials

File: packages/server/src/app.ts (lines 64-69)

await app.register(cors, {
  origin: true, // Allow all origins in development
  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  credentials: true,
});

Problem: The comment says "development" but this is the production server configuration. With credentials: true, any website can make authenticated cross-origin requests carrying the auth cookie.

Fix: Gate origin: true on a dev-mode config flag, or set to specific allowed origins in production.

2. Auth cookie missing Secure flag

File: packages/server/src/auth/plugin.ts (line 83)

reply.header('Set-Cookie', `${AUTH_COOKIE_NAME}=${config.auth.password}; HttpOnly; Path=/; SameSite=Lax`);

Problem: Missing Secure flag. Over plain HTTP, the cookie will be sent in cleartext and susceptible to interception.

Fix: Conditionally add Secure flag based on NODE_ENV === 'production' or deployment config.


Both issues should be fixed before merging feature/refactor-ts.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions