From bce6c57b6ac8adb5466d42663ec0b889e657d5c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20=C5=A0ediv=C3=BD?= Date: Wed, 5 Aug 2026 16:28:42 +0200 Subject: [PATCH] fix: update CORS handling to log warnings for wildcard usage and disable cors by default. (#674) --- server/internal/config/server.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/server/internal/config/server.go b/server/internal/config/server.go index ac76e87b..c094fbc7 100644 --- a/server/internal/config/server.go +++ b/server/internal/config/server.go @@ -120,8 +120,9 @@ func (s *Server) Set() { s.Metrics = viper.GetBool("server.metrics") s.CORS = viper.GetStringSlice("server.cors") - if len(s.CORS) == 0 || slices.Contains(s.CORS, "*") { + if slices.Contains(s.CORS, "*") { s.CORS = []string{"*"} + log.Warn().Msg("CORS is enabled for all origins, this is not recommended for production environments") } } @@ -160,8 +161,9 @@ func (s *Server) SetV2() { } if viper.IsSet("cors") { s.CORS = viper.GetStringSlice("cors") - if len(s.CORS) == 0 || slices.Contains(s.CORS, "*") { + if slices.Contains(s.CORS, "*") { s.CORS = []string{"*"} + log.Warn().Msg("CORS is enabled for all origins, this is not recommended for production environments") } log.Warn().Msg("you are using v2 configuration 'NEKO_CORS' which is deprecated, please use 'NEKO_SERVER_CORS' instead") enableLegacy = true