AR: CORS allow_origins=["*"] is unnecessarily permissive for a private API

[gregoryfoster]

Problem

main.py configures CORS with allow_origins=["*"], opening the API to cross-origin requests from any browser origin. While API-key authentication reduces the risk compared to cookie-authenticated APIs, wildcard CORS is still unnecessarily permissive for what appears to be a private/internal service (per license_info: Proprietary).

Impact

• Any browser-side script on any domain can make cross-origin preflight and authenticated requests
• If the API key is ever exposed client-side, CORS provides no additional barrier

Fix

Restrict allow_origins to the set of known consumer origins. If the consumer origins are not known at deploy time, make ALLOWED_ORIGINS a configurable env var (comma-separated list, defaulting to a restrictive set).

If public browser access is genuinely required, document the rationale in main.py alongside the setting.

Source

AR finding #6 (architectural review 2026-03-18).

[gregoryfoster]

Additional context from architectural review (finding #13)

The allow_origins=["*"] with allow_headers=["*"] is safe behind the exe.dev proxy, but if the service were ever exposed directly, any origin could make authenticated API calls with stolen API keys. The X-API-Key header auth combined with permissive CORS means a malicious page could call the API from a browser if the key leaks.

Consider tightening to the known admin dashboard origin(s) or the exe.dev proxy domain at minimum.

🤖 Generated with Claude Code