add LEDGER NOTE flagging permissive CORS for follow-up

7a4c7ef234477010b39fdfde589960e5848da96b · 2026-05-19 22:15:04 -0700 · Steve

SSRF was the prioritized hardening; CORS origin:"*" is intentionally
left in place because the only known client (public/index.html) is
same-origin and tightening to a guessed allowlist could break an
undocumented embed. Note records the trade-off + recommends a
CORS_ALLOWED_ORIGINS env-var as the next step.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 7a4c7ef234477010b39fdfde589960e5848da96b
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue May 19 22:15:04 2026 -0700

    add LEDGER NOTE flagging permissive CORS for follow-up
    
    SSRF was the prioritized hardening; CORS origin:"*" is intentionally
    left in place because the only known client (public/index.html) is
    same-origin and tightening to a guessed allowlist could break an
    undocumented embed. Note records the trade-off + recommends a
    CORS_ALLOWED_ORIGINS env-var as the next step.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/server.js b/server.js
index 89a852a..43addfa 100644
--- a/server.js
+++ b/server.js
@@ -11,6 +11,14 @@ const app = express();
 // Security headers via helmet (added 2026-05-04 overnight YOLO loop)
 app.use(helmet({ contentSecurityPolicy: false }));
 const server = createServer(app);
+
+// LEDGER NOTE 2026-05-19 — CORS is intentionally left as origin:"*" pending
+// a real allowlist. The frontend at public/index.html uses io() (same-origin)
+// and fetch() against same-origin paths, so no documented cross-origin client
+// exists. SSRF was the higher-priority hardening (shipped this commit); a
+// follow-up should set CORS_ALLOWED_ORIGINS env-var and gate both Express and
+// Socket.IO on it before this lands on a public IP. Leaving open for now to
+// avoid breaking any undocumented embed.
 const io = new Server(server, {
   cors: {
     origin: "*",

← 0a1b751 wire 'npm test' to the SSRF test suite · back to Web Viewer 3877 · add: pre-stage Meta Pixel snippet (placeholder; flip via _dw d7af8ce →