From 9350f42a93dbe203fda7fcedde0e5f6831398fd8 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sun, 18 Oct 2026 23:12:38 +0000
Subject: [PATCH] fix: Explicitly disable CORS credentials in agent_server.py

The FastAPI/Starlette CORSMiddleware defaults to `allow_credentials=False` if not specified, but omitting it can flag security policies in scanners and lacks defense-in-depth against future configuration drift. Setting `allow_credentials=False` makes the default explicit and prevents credentialed CORS requests in this environment.

Co-authored-by: tteon <52625664+tteon@users.noreply.github.com>
---
 runtime/agent_server.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/runtime/agent_server.py b/runtime/agent_server.py
index 3f7d6298..1219d860 100644
--- a/runtime/agent_server.py
+++ b/runtime/agent_server.py
@@ -171,6 +171,7 @@ def __getattr__(self, name):
     allow_origins=_cors_origins,
     allow_methods=["POST", "GET"],
     allow_headers=["Content-Type", "Authorization", "X-Request-Id"],
+    allow_credentials=False,
 )