fix(http): relax CORP to cross-origin so allow-listed clients can load resources - #165
Merged
dev-fani merged 2 commits intoAug 30, 2026
Merged
Conversation
…d resources Helmet's default crossOriginResourcePolicy is `same-origin`, which browsers enforce independently of CORS. The CORS_ORIGIN allow-list and Helmet's nested contentSecurityPolicy override did nothing about it, so allow-listed cross-origin clients were silently blocked from loading this API's responses (e.g. an evidence image rendered via `<img>`). Set crossOriginResourcePolicy to `cross-origin`, matching the CORS allow-list intent, and document the tradeoff in SECURITY.md. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
|
@Sundriveauto Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #115
Closes #116
Closes #117
Closes #118
Summary
The
securityPluginregisters@fastify/helmetwith an explicitcontentSecurityPolicyoverride but left every other Helmet directive at its default — includingcrossOriginResourcePolicy, whose default issame-origin(confirmed for thehelmetv7/v8 line that@fastify/helmet@12wraps).Cross-Origin-Resource-Policyis enforced by browsers independently of CORS. It governs whether a different origin may load this origin's response at all via a no-CORS-mode request (e.g.<img src>,<script>, fonts). TheCORS_ORIGINallow-list and the CSP override insecurityPlugindo nothing about it, so allow-listed cross-origin clients were silently blocked from loading this API's responses in no-CORS mode — for example, an uploaded dispute-evidence image rendered with<img src="...">pointing at this API.Change
src/shared/http/plugins/security.ts: setcrossOriginResourcePolicy: { policy: 'cross-origin' }explicitly, with an explanatory comment. This matches the CORS allow-list intent so cooperating client origins can actually load API resources, while the strict CSP, origin allow-list, andcredentials: truerestrictions are untouched.docs/SECURITY.md: document the CORP policy and the rationale (independent of CORS enforcement).Tradeoff
cross-originweakens CORP's default isolation across all origins. This is intended: the API already restricts cooperating origins viaCORS_ORIGIN, and thesame-origindefault silently breaks no-CORS-mode resource loads those clients depend on. If strict isolation is ever required, evidence/media should be served from a separate static/CDN origin.Testing
Typecheck could not be run locally because
node_modulesis not installed in the working checkout. The change is a standard, type-validhelmetoption; please runpnpm install && pnpm typecheckto confirm.