Rockachopa/Timmy-time-dashboard
1
0
Fork 2
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

[loop-generated] [bug] CORS origins default to wildcard in production #462

New Issue
Closed
opened 2026-03-19 18:43:16 +00:00 by Timmy · 1 comment
Timmy commented 2026-03-19 18:43:16 +00:00
Owner
Copy Link

What

config.py line 141: cors_origins: list[str] = ["*"]

In production, wildcard CORS allows any origin to make authenticated requests to the dashboard API. This is a sovereignty violation — anyone can interact with Timmy's API from any website.

Why

SOUL.md: "I do not phone home." Wildcard CORS is the reverse — it lets anyone phone IN.

Acceptance criteria

  • Default CORS origins should be restrictive (localhost only)
  • Production should require explicit CORS_ORIGINS env var
  • Add warning log if wildcard CORS is used
  • Unit test verifying default is not wildcard

Files

  • src/config.py
  • src/dashboard/app.py
  • tests/
## What `config.py` line 141: `cors_origins: list[str] = ["*"]` In production, wildcard CORS allows any origin to make authenticated requests to the dashboard API. This is a sovereignty violation — anyone can interact with Timmy's API from any website. ## Why SOUL.md: "I do not phone home." Wildcard CORS is the reverse — it lets anyone phone IN. ## Acceptance criteria - Default CORS origins should be restrictive (localhost only) - Production should require explicit CORS_ORIGINS env var - Add warning log if wildcard CORS is used - Unit test verifying default is not wildcard ## Files - src/config.py - src/dashboard/app.py - tests/
Timmy commented 2026-03-19 18:43:30 +00:00
Author
Owner
Copy Link

Implementation Guide

  1. In src/config.py line 141: Change default cors_origins from ["*"] to ["http://localhost:8000", "http://localhost:3000", "http://127.0.0.1:8000", "http://127.0.0.1:3000"]

  2. In src/dashboard/app.py in _get_cors_origins(): Add a warning log if "*" is in the origins list: logger.warning("CORS wildcard enabled — restrict in production via CORS_ORIGINS env var")

  3. Add a unit test in tests/unit/test_config.py (or create if needed) that asserts "*" is NOT in the default cors_origins.

Verify:

  • tox -e unit passes
  • tox -e lint passes
## Implementation Guide 1. In `src/config.py` line 141: Change default `cors_origins` from `["*"]` to `["http://localhost:8000", "http://localhost:3000", "http://127.0.0.1:8000", "http://127.0.0.1:3000"]` 2. In `src/dashboard/app.py` in `_get_cors_origins()`: Add a warning log if `"*"` is in the origins list: `logger.warning("CORS wildcard enabled — restrict in production via CORS_ORIGINS env var")` 3. Add a unit test in `tests/unit/test_config.py` (or create if needed) that asserts `"*"` is NOT in the default `cors_origins`. ### Verify: - `tox -e unit` passes - `tox -e lint` passes
kimi was assigned by Timmy 2026-03-19 18:43:30 +00:00
Timmy closed this issue 2026-03-19 18:57:38 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
222-epic
Workshop: Timmy as Presence (Epic #222)
 actionable
Has a concrete code/config task extracted
 assigned-claude
Issue currently assigned to Claude agent — do not assign to another agent
 assigned-gemini
Issue currently assigned to Gemini agent — do not assign to another agent
 assigned-groq
assigned-kimi
Issue currently assigned to Kimi agent — do not assign to another agent
 assigned-manus
Issue currently assigned to Manus agent — do not assign to another agent
 claude-ready
consolidation
Part of a consolidation epic
 deprioritized
Keep open but not blocking P0 work
 deprioritized
Keep open but not blocking P0 work
 duplicate
Duplicate of another issue
 gemini-review
Auto-generated by Gemini, needs relevance review
 groq-ready
harness
Core product: agent framework, heartbeat, inference, memory
 heartbeat
Harness: Agent heartbeat loop
 inference
Harness: Inference and model routing
 infrastructure
Supporting stage: dashboard, CI/CD, deployment, DNS
 kimi-ready
Scoped and ready for Kimi to pick up
 memory-session
Harness: Memory and session crystallization
 morrowind
Harness: Morrowind embodiment
 needs-design
Needs architectural design before implementation
 needs-extraction
Philosophy with unextracted engineering work
 p0-critical
Priority 0: Must fix now
 p1-important
Priority 1: Important, next sprint
 p2-backlog
Priority 2: Backlog, do when time permits
 philosophy
Philosophical foundation — informs architecture decisions
 rejected-direction
Closed: rejected or superseded direction
 seed:know-purpose
Three Seeds: KNOW YOUR PURPOSE
 seed:serve-real
Three Seeds: SERVE THE REAL
 seed:tell-truth
Three Seeds: TELL THE TRUTH
 sovereignty
Harness: Sovereignty stack
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Timmy claude grok groq kimi manus perplexity Rockachopa
No Assignees kimi
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Rockachopa/Timmy-time-dashboard#462
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?