From 7cadc0f84bbf133e91353e779265ca7f348da495 Mon Sep 17 00:00:00 2001
From: Evan Alferez <eoalferez@gmail.com>
Date: Thu, 4 Jun 2026 08:44:31 +0900
Subject: [PATCH] fix(security): remove wildcard CORS from progress SSE
 endpoint

The progress stream is consumed via same-origin EventSource, so a
wildcard Access-Control-Allow-Origin header is unnecessary and could
expose user-scoped progress events to arbitrary origins.

Fixes #87
---
 app/api/progress/[progressId]/route.ts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/app/api/progress/[progressId]/route.ts b/app/api/progress/[progressId]/route.ts
index 7dc248de..415190f1 100644
--- a/app/api/progress/[progressId]/route.ts
+++ b/app/api/progress/[progressId]/route.ts
@@ -58,7 +58,6 @@ export async function GET(req: NextRequest, { params }: { params: Promise<{ prog
       "Content-Type": "text/event-stream",
       "Cache-Control": "no-cache, no-transform",
       Connection: "keep-alive",
-      "Access-Control-Allow-Origin": "*",
     },
   })
 }