Skip to content

fix(sc): restrict CORS wildcard and add server idle timeout#75

Open
theautoroboto wants to merge 1 commit into
mainfrom
fedramp/SC-08-cors-restriction-2026-04-22
Open

fix(sc): restrict CORS wildcard and add server idle timeout#75
theautoroboto wants to merge 1 commit into
mainfrom
fedramp/SC-08-cors-restriction-2026-04-22

Conversation

@theautoroboto

@theautoroboto theautoroboto commented Apr 22, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown
Contributor

FedRAMP Remediation — SC-08 / AC-12: Transmission Confidentiality and Session Termination

Jira: ROSAENG-387, ROSAENG-389
Epic: ROSAENG-249

Finding

pkg/server/server.go uses a hardcoded "*" CORS wildcard, allowing any origin — failing SC-08 (transmission protection). No IdleTimeout is configured on the HTTP server, failing AC-12 (session termination).

Change

  • pkg/config/config.go — added AllowedOrigins []string to ServerConfig
  • pkg/server/server.go — replaced hardcoded "*" with cfg.Server.AllowedOrigins; operator warning log when list is empty; added IdleTimeout: 120 * time.Second to the HTTP server

References

🤖 Generated by fedramp-compliance agent on 2026-04-22

@theautoroboto
fix(sc): restrict CORS origins and add IdleTimeout for SC-08/AC-12
ec66c59 
FedRAMP SC-08 requires transmission confidentiality and integrity
controls. A wildcard CORS AllowedOrigins ("*") allows any browser
origin to read API responses, bypassing same-origin protection.

Changes:
- config.go: add ServerConfig.AllowedOrigins []string field with
  an empty default and doc comment explaining the FedRAMP constraint
- server.go: use cfg.Server.AllowedOrigins instead of hardcoded
  wildcard; log a warning when the list is empty so operators know
  they must set --allowed-origins before serving browser clients
- server.go: add IdleTimeout: 120s to the API http.Server to satisfy
  AC-12 session termination requirements for keep-alive connections

Jira: ROSAENG-387, ROSAENG-389
@theautoroboto theautoroboto added fedramp FedRAMP compliance remediation compliance Compliance-related change automated Generated by automation labels Apr 22, 2026
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 22, 2026
@openshift-ci

openshift-ci Bot commented Apr 22, 2026

Copy link
Copy Markdown

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@coderabbitai

coderabbitai Bot commented Apr 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)
  • do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d8468d74-8a75-47f1-83fa-e08eb2afc2fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fedramp/SC-08-cors-restriction-2026-04-22

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci

openshift-ci Bot commented Apr 22, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: theautoroboto

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@theautoroboto
theautoroboto marked this pull request as ready for review April 22, 2026 21:30
@theautoroboto theautoroboto added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Apr 22, 2026
@openshift-ci openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 22, 2026
@openshift-ci openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 10, 2026
@openshift-ci

openshift-ci Bot commented Jun 10, 2026

Copy link
Copy Markdown

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

automated Generated by automation compliance Compliance-related change fedramp FedRAMP compliance remediation needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@theautoroboto