No CORS configuration — API accepts requests from any origin
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- typescript
Research direction
Start in src/main.ts at the NestFactory bootstrap and review how the Fastify adapter is configured. Check how the frontend URL is provided through environment configuration, then verify requests from the known frontend origin and an arbitrary origin. Done means only the configured frontend origin is accepted with the listed credentials and methods.
Written by the indexing model from the issue text.
Description
Description
In src/main.ts, the Fastify-based NestJS application does not configure any CORS restrictions:
const app = await NestFactory.create<NestFastifyApplication>(
AppModule,
new FastifyAdapter()
);
By default, Fastify/NestJS with no explicit CORS config either accepts all origins or uses the framework's permissive defaults. This means any website can make authenticated API requests to the Hub endpoints, enabling CSRF attacks and cross-origin data theft.
Steps to Reproduce
- From any arbitrary domain, send a CORS request to
https://hub-api/api/v1/* - The request succeeds without CORS preflight rejection
Expected Behavior
Only known frontend origins (the OpenLake Hub frontend domain) should be allowed to make cross-origin requests.
Suggested Fix
app.enableCors({
origin: [process.env.FRONTEND_URL],
credentials: true,
methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'],
});
Affected Files
src/main.ts
- Dominant language
- TypeScript
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from OpenLake/Hub
-
advanced bug security
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
enhancement help wanted
Difficulty 4/5 3-5 days Newbie friendliness 55/100
-
bug help wanted security
Difficulty 3/5 1-2 days Newbie friendliness 70/100
-
enhancement help wanted
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Proxy module has no request validation — passes through malicious payloads to downstream services Openbug help wanted security
Difficulty 5/5 Over a week Newbie friendliness 42/100
Similar issues
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 91/100
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100