PAD_CORS_ORIGINS accepted any string (including '*') while the CORS
middleware ran with AllowCredentials=true unconditionally. Browsers
refuse the combination per the Fetch spec, so a typo like
PAD_CORS_ORIGINS=* "worked" in curl but failed silently from every
real browser — and without an explicit carve-out, an anon cross-origin
fetch still rode the victim's cookies when origins were empty.
- parseCORSOrigins: explicitly drop '*' with a log warning. When '*'
was the ONLY configured origin, fall back to localhost defaults
rather than producing an empty allowlist.
- corsAllowCredentials: new helper — AllowCredentials=true only when
an operator has set PAD_CORS_ORIGINS. Default false keeps a browser
on a different origin from piggy-backing cookies on the user's
session when no remote origin was expected in the first place.
- server.go: wire up corsAllowCredentials(s.corsOrigins) into the
cors.Options.
Tests:
- TestParseCORSOrigins gains three '*'-handling cases (lone '*',
mixed, trailing '*').
- TestCorsAllowCredentials covers empty/whitespace default, explicit
origins, and tab-only input.
Parent: PLAN-643 (OSS Security Hardening).
xarmian
a2eaac4a37